diff --git a/scripts/update.sh b/scripts/update.sh
index 4c34202..f113b72 100644
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -168,7 +168,7 @@ _sudoers_add(){
   printf '%s\n' "$rule" >> "$file"
   chmod 440 "$file"
 }
-fix_permissions(){
+fix_ownership(){
   # Alle App-Dateien dem APP_USER zuweisen (git läuft als root → neue Dateien wären sonst root-owned)
   # node_modules + vendor ausklammern (zu groß, werden separat behandelt)
   for d in app bootstrap config database public resources routes scripts storage; do
@@ -177,10 +177,13 @@ fix_permissions(){
   for f in artisan composer.json composer.lock package.json package-lock.json .env vite.config.js vite.config.ts; do
     [[ -e "${APP_DIR}/${f}" ]] && chown "${APP_USER}:${APP_GROUP}" "${APP_DIR}/${f}" 2>/dev/null || true
   done
-
   chmod -R ug+rwX "${APP_DIR}/bootstrap/cache" "${APP_DIR}/storage" 2>/dev/null || true
   find "${APP_DIR}/bootstrap/cache" "${APP_DIR}/storage" \
     -type d -exec chmod g+s {} \; 2>/dev/null || true
+}
+
+fix_permissions(){
+  fix_ownership
 
   # Frontend fehlt → rebuild
   if [[ ! -f "${APP_DIR}/public/build/manifest.json" ]]; then
@@ -272,8 +275,13 @@ MAINTENANCE_ACTIVE=0
 _cleanup() {
   local rc=$?
   [[ "$MAINTENANCE_ACTIVE" -eq 1 ]] && artisan_up
-  # Rechte + Cache IMMER korrigieren — auch bei Fehler-Abbruch
-  fix_permissions
+  # Ownership immer korrigieren; Cache nur bei Fehler neu aufbauen
+  # (bei Erfolg hat fix_permissions im Hauptfluss bereits optimize gebaut)
+  if [[ $rc -ne 0 ]]; then
+    fix_permissions
+  else
+    fix_ownership
+  fi
   mkdir -p "$STATE_DIR"
   echo "done" > "$STATE_DIR/state"
   echo "$rc"  > "$STATE_DIR/rc"