diff --git a/deploy-vps.sh b/deploy-vps.sh
index f5d0e5d..4dc7ca7 100755
--- a/deploy-vps.sh
+++ b/deploy-vps.sh
@@ -1,19 +1,19 @@
 #!/usr/bin/env bash
-# deploy-w-make-portfolio.sh
-# Deployment-Script für w-make.com Portfolio auf free-warez.win VPS
+# deploy-w-make.sh
+# Deployment-Script für w-make.com (Portfolio + Updates-API)
 # Generiert von Jcode am 2026-08-22
 
 set -euo pipefail
 
-echo "🚀 W-Make Portfolio Deployment"
-echo "================================"
+echo "🚀 W-Make.com Deployment"
+echo "========================="
 echo ""
 
 # 1. Zum Projekt-Verzeichnis navigieren
 if [ -d "/home/eldov/projects/w-make-portfolio" ]; then
     PROJECT_DIR="/home/eldov/projects/w-make-portfolio"
-elif [ -d "/opt/w-make-portfolio" ]; then
-    PROJECT_DIR="/opt/w-make-portfolio"
+elif [ -d "/opt/containers/w-make-portfolio" ]; then
+    PROJECT_DIR="/opt/containers/w-make-portfolio"
 elif [ -d "/srv/w-make-portfolio" ]; then
     PROJECT_DIR="/srv/w-make-portfolio"
 else
@@ -42,48 +42,94 @@ echo ""
 echo "✨ Neue Commits:"
 git log --oneline -5
 
-# 5. Docker Image neu bauen
+# 5. .env für updates-api prüfen
 echo ""
-echo "🔨 Baue Docker Image neu (w-make-portfolio)..."
-docker-compose build w-make-portfolio
+echo "🔑 Prüfe .env für updates-api..."
+if [ ! -f ".env" ]; then
+    echo "⚠️  .env nicht gefunden, erstelle mit Placeholder..."
+    echo "UPDATES_ADMIN_TOKEN=$(openssl rand -hex 32)" > .env
+    echo "SMTP_PASS=placeholder" >> .env
+    echo "   ⚠️  Bitte UPDATES_ADMIN_TOKEN und SMTP_PASS in .env anpassen!"
+else
+    echo "✅ .env existiert"
+fi
 
-# 6. Container neu starten
+# 6. Docker Images neu bauen
+echo ""
+echo "🔨 Baue Docker Images neu..."
+docker-compose build w-make-portfolio
+docker-compose build updates-api
+
+# 7. Container neu starten
 echo ""
 echo "🔄 Starte Container neu..."
 docker-compose up -d w-make-portfolio
+docker-compose up -d updates-api
 
-# 7. Warte auf Startup
+# 8. Warte auf Startup
 echo ""
-echo "⏳ Warte 5 Sekunden auf Container-Start..."
-sleep 5
+echo "⏳ Warte 8 Sekunden auf Container-Start..."
+sleep 8
 
-# 8. Health-Check
+# 9. Health-Checks
 echo ""
-echo "🏥 Health-Check:"
+echo "🏥 Health-Checks:"
 if curl -sf http://localhost:3000/api/health > /dev/null 2>&1; then
-    echo "✅ Health-Endpoint erreichbar"
+    echo "✅ Portfolio Health-Endpoint erreichbar"
     curl -s http://localhost:3000/api/health | python3 -m json.tool
 else
-    echo "⚠️  Health-Endpoint nicht erreichbar (möglicherweise noch am Starten)"
+    echo "⚠️  Portfolio Health-Endpoint nicht erreichbar (möglicherweise noch am Starten)"
 fi
 
-# 9. Container-Logs anzeigen
+if curl -sf http://localhost:8080/healthz > /dev/null 2>&1; then
+    echo "✅ Updates-API Health-Endpoint erreichbar"
+    curl -s http://localhost:8080/healthz | python3 -m json.tool
+else
+    echo "⚠️  Updates-API Health-Endpoint nicht erreichbar"
+fi
+
+# 10. Traefik Routing validieren
+echo ""
+echo "🌐 Routing-Tests:"
+echo -n "  https://w-make.com → "
+if curl -sf -o /dev/null https://w-make.com 2>/dev/null; then
+    echo "✅ 200 OK"
+else
+    echo "⚠️  Nicht erreichbar"
+fi
+
+echo -n "  https://w-make.com/admin → "
+if curl -sf -o /dev/null https://w-make.com/admin 2>/dev/null; then
+    echo "✅ Erreichbar (Authelia-Redirect oder 401)"
+else
+    echo "⚠️  Nicht erreichbar"
+fi
+
+echo -n "  https://w-make.com/v1/updates → "
+if curl -sf -o /dev/null https://w-make.com/v1/updates 2>/dev/null; then
+    echo "✅ Erreichbar"
+else
+    echo "⚠️  Nicht erreichbar"
+fi
+
+# 11. Container-Logs anzeigen
 echo ""
 echo "📋 Container-Logs (letzte 20 Zeilen):"
 docker-compose logs --tail=20 w-make-portfolio
-
-# 10. Status-Zusammenfassung
 echo ""
-echo "================================"
+docker-compose logs --tail=20 updates-api
+
+# 12. Status-Zusammenfassung
+echo ""
+echo "========================="
 echo "✅ Deployment abgeschlossen!"
 echo ""
 echo "Nächste Schritte:"
 echo "1. Prüfe https://w-make.com im Browser"
-echo "2. Validiere die neuen Änderungen:"
-echo "   - Hero: 'Wenn Zahlen zwischen Schichten verschwinden...'"
-echo "   - Demo-CTA nach Hero-Section"
-echo "   - CTA-Box mit Benefit-Liste (✓)"
+echo "2. Prüfe https://w-make.com/admin (Authelia-Login)"
+echo "3. Prüfe https://w-make.com/v1/updates (API)"
 echo ""
 echo "Bei Problemen:"
 echo "  docker-compose logs -f w-make-portfolio"
+echo "  docker-compose logs -f w-make-updates-api"
 echo ""
diff --git a/docker-compose.yml b/docker-compose.yml
index cc8b9ee..5d77f16 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -57,23 +57,21 @@ services:
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=proxy"
-      - "traefik.http.routers.w-make-updates.rule=Host(`updates.w-make.com`)"
-      - "traefik.http.routers.w-make-updates.priority=10"
-      - "traefik.http.routers.w-make-updates.entrypoints=websecure"
-      - "traefik.http.routers.w-make-updates.tls=true"
-      - "traefik.http.routers.w-make-updates.tls.certresolver=http_resolver"
-      - "traefik.http.routers.w-make-updates.middlewares=default@file,crowdsec-bouncer-plugin@file"
+      # Öffentliche API-Routen (hohe Priorität, before portfolio)
+      - "traefik.http.routers.w-make-api.rule=Host(`w-make.com`) && (PathPrefix(`/v1`) || PathPrefix(`/feed.xml`))"
+      - "traefik.http.routers.w-make-api.priority=150"
+      - "traefik.http.routers.w-make-api.entrypoints=websecure"
+      - "traefik.http.routers.w-make-api.tls=true"
+      - "traefik.http.routers.w-make-api.tls.certresolver=http_resolver"
+      - "traefik.http.routers.w-make-api.middlewares=default@file,crowdsec-bouncer-plugin@file"
       - "traefik.http.services.w-make-updates.loadbalancer.server.port=8080"
-      - "traefik.http.middlewares.wmake-updates-authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.w-make.com"
-      - "traefik.http.middlewares.wmake-updates-authelia.forwardauth.trustForwardHeader=true"
-      - "traefik.http.middlewares.wmake-updates-authelia.forwardauth.authResponseHeaders=Remote-User,Remote-Groups"
-      - "traefik.http.routers.w-make-updates-admin.rule=Host(`updates.w-make.com`) && (PathPrefix(`/admin`) || PathPrefix(`/v1/admin`))"
-      - "traefik.http.routers.w-make-updates-admin.priority=200"
-      - "traefik.http.routers.w-make-updates-admin.entrypoints=websecure"
-      - "traefik.http.routers.w-make-updates-admin.tls=true"
-      - "traefik.http.routers.w-make-updates-admin.tls.certresolver=http_resolver"
-      - "traefik.http.routers.w-make-updates-admin.middlewares=default@file,crowdsec-bouncer-plugin@file,wmake-updates-authelia@docker"
-      - "traefik.http.routers.w-make-updates-admin.service=w-make-updates"
+      # Admin-UI (höchste Priorität, Authelia-Schutz)
+      - "traefik.http.routers.w-make-admin.rule=Host(`w-make.com`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.w-make-admin.priority=200"
+      - "traefik.http.routers.w-make-admin.entrypoints=websecure"
+      - "traefik.http.routers.w-make-admin.tls=true"
+      - "traefik.http.routers.w-make-admin.tls.certresolver=http_resolver"
+      - "traefik.http.routers.w-make-admin.middlewares=default@file,crowdsec-bouncer-plugin@file"
     networks:
       - proxy
 
diff --git a/services/updates-api/src/admin-links.html b/services/updates-api/src/admin-links.html
index c400576..5c4d7a7 100644
--- a/services/updates-api/src/admin-links.html
+++ b/services/updates-api/src/admin-links.html
@@ -62,7 +62,7 @@
 <body>
   <header>
     <div>
-      <p class="kicker">Authelia · updates.w-make.com</p>
+      <p class="kicker">Authelia · w-make.com</p>
       <h1>Links-Verwaltung</h1>
     </div>
     <button class="ghost" id="new-btn" type="button">Neuer Link</button>
diff --git a/services/updates-api/src/admin.html b/services/updates-api/src/admin.html
index 343b238..f5b4ab1 100644
--- a/services/updates-api/src/admin.html
+++ b/services/updates-api/src/admin.html
@@ -62,7 +62,7 @@
 <body>
   <header>
     <div>
-      <p class="kicker">Authelia · updates.w-make.com</p>
+      <p class="kicker">Authelia · w-make.com</p>
       <h1>Produkt-Updates</h1>
     </div>
     <button class="ghost" id="new-btn" type="button">Neues Update</button>