diff --git a/install.sh b/install.sh
index a05f50b..ef9f8ad 100755
--- a/install.sh
+++ b/install.sh
@@ -244,6 +244,9 @@ HOST_TZ="$(timedatectl show -p Timezone --value 2>/dev/null || true)"
 force_kv APP_TIMEZONE "$HOST_TZ"
 info "Secrets ok; Proxy/URL aus APP_DOMAIN abgeleitet; Zeitzone ${HOST_TZ}"
 
+# Pin the update source to wherever this was cloned from (keeps private URLs out of tracked files).
+[ -x "$(pwd)/scripts/set-repository-url.sh" ] && "$(pwd)/scripts/set-repository-url.sh" "$(pwd)" "$(pwd)/.env" || true
+
 # ── [4/9] image ──────────────────────────────────────────────────────
 phase 4/9 "Image bauen"
 set_stage build
diff --git a/scripts/set-repository-url.sh b/scripts/set-repository-url.sh
new file mode 100755
index 0000000..9878fa8
--- /dev/null
+++ b/scripts/set-repository-url.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Derive the update source (CLUSEV_REPOSITORY) from the clone origin and write it into the given .env.
+# Called by install.sh + update.sh. The private (Gitea/GitHub-private) URL therefore lives ONLY in the
+# gitignored .env — never in a tracked file. No-op (exit 0) when there is no origin remote.
+#   usage: set-repository-url.sh <project-dir> <env-file>
+set -euo pipefail
+
+proj="${1:?project dir required}"
+envfile="${2:?env file required}"
+
+url="$(git -C "$proj" remote get-url origin 2>/dev/null || true)"
+url="${url%.git}"            # normalise — the API host is the same with or without .git
+url="${url%/}"               # drop a trailing slash
+[ -n "$url" ] || exit 0      # no origin (e.g. tarball install) → leave .env untouched
+
+if grep -q '^CLUSEV_REPOSITORY=' "$envfile" 2>/dev/null; then
+    # Drop every existing line, then re-append once — collapses any duplicates to a single entry.
+    sed -i '/^CLUSEV_REPOSITORY=/d' "$envfile"
+fi
+printf 'CLUSEV_REPOSITORY=%s\n' "$url" >> "$envfile"
diff --git a/scripts/set-repository-url.test.sh b/scripts/set-repository-url.test.sh
new file mode 100644
index 0000000..755ec00
--- /dev/null
+++ b/scripts/set-repository-url.test.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Test: set-repository-url.sh writes CLUSEV_REPOSITORY (derived from the clone origin) into the .env,
+# creating or replacing the line, and strips a trailing .git.
+set -euo pipefail
+here="$(cd "$(dirname "$0")" && pwd)"
+work="$(mktemp -d)"; trap 'rm -rf "$work"' EXIT
+
+git init -q "$work/proj"
+git -C "$work/proj" remote add origin https://git.example.com/o/clusev.git
+printf 'APP_ENV=local\n' > "$work/proj/.env"
+
+bash "$here/set-repository-url.sh" "$work/proj" "$work/proj/.env"
+grep -qx 'CLUSEV_REPOSITORY=https://git.example.com/o/clusev' "$work/proj/.env" || { echo "FAIL: append/strip-.git"; exit 1; }
+
+# replace an existing line
+printf 'CLUSEV_REPOSITORY=old\n' >> "$work/proj/.env"
+git -C "$work/proj" remote set-url origin https://gitea.local/u/clusev
+bash "$here/set-repository-url.sh" "$work/proj" "$work/proj/.env"
+test "$(grep -c '^CLUSEV_REPOSITORY=' "$work/proj/.env")" = 1 || { echo "FAIL: duplicate line"; exit 1; }
+grep -qx 'CLUSEV_REPOSITORY=https://gitea.local/u/clusev' "$work/proj/.env" || { echo "FAIL: replace"; exit 1; }
+
+# no origin → no-op, no crash
+git init -q "$work/noremote"; printf '' > "$work/noremote/.env"
+bash "$here/set-repository-url.sh" "$work/noremote" "$work/noremote/.env"
+grep -q 'CLUSEV_REPOSITORY' "$work/noremote/.env" && { echo "FAIL: wrote without origin"; exit 1; }
+
+echo "PASS"
diff --git a/update.sh b/update.sh
index fc8769a..bb450a4 100755
--- a/update.sh
+++ b/update.sh
@@ -62,6 +62,9 @@ if [ "${CLUSEV_UPDATE_REEXEC:-0}" != 1 ]; then
   fi
 fi
 
+# Refresh the update source from the (possibly changed) clone origin before handing off.
+[ -x ./scripts/set-repository-url.sh ] && ./scripts/set-repository-url.sh "$(pwd)" ./.env || true
+
 # 4. apply via the idempotent installer, non-interactively (no prompts; config preserved)
 info "Wende Update an (install.sh) ..."
 exec ./install.sh </dev/null