diff --git a/scripts/update.sh b/scripts/update.sh
index 039b6e2..8750ca9 100644
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -158,6 +158,16 @@ _sudoers_add(){
   printf '%s\n' "$rule" >> "$file"
   chmod 440 "$file"
 }
+fix_permissions(){
+  chown -R "${APP_USER}:${APP_GROUP}" \
+    "${APP_DIR}/bootstrap/cache" \
+    "${APP_DIR}/storage" \
+    "${APP_DIR}/public/build" 2>/dev/null || true
+  chmod -R ug+rwX \
+    "${APP_DIR}/bootstrap/cache" \
+    "${APP_DIR}/storage" 2>/dev/null || true
+}
+
 ensure_system(){
   # Scripts nach sbin
   _sbin_install "${APP_DIR}/scripts/mailwolt-apply-domains" /usr/local/sbin/mailwolt-apply-domains
@@ -325,6 +335,7 @@ if [[ $NEED_COMPOSER -eq 0 && $NEED_MIGRATIONS -eq 0 && $NEED_FRONTEND -eq 0 &&
   NEW_VER="$(get_version)"
   write_build_info "$NEW_VER" "$NEW_REV"
   echo "[i] Version: ${OLD_VER} → ${NEW_VER}"
+  fix_permissions
   ensure_system
   exit 0
 fi
@@ -361,9 +372,6 @@ if [[ $NEED_PHP_RESTART -eq 1 || $NEED_COMPOSER -eq 1 || $NEED_MIGRATIONS -eq 1
   as_app "cd ${APP_DIR} && php artisan config:cache || true"
   as_app "cd ${APP_DIR} && php artisan route:cache || true"
   as_app "cd ${APP_DIR} && php artisan queue:restart || true"
-  # Rechte: bootstrap/cache und storage müssen für www-data lesbar sein
-  chown -R "${APP_USER}:${APP_GROUP}" "${APP_DIR}/bootstrap/cache" "${APP_DIR}/storage" 2>/dev/null || true
-  chmod -R g+rX "${APP_DIR}/bootstrap/cache" "${APP_DIR}/storage" 2>/dev/null || true
 fi
 
 # -------- Dienste neu laden (gezielt) ----------------------------------------
@@ -388,6 +396,7 @@ fi
 NEW_VER="$(get_version)"
 write_version_files "$NEW_VER" "$NEW_REV"
 
+fix_permissions
 echo "[✓] Update abgeschlossen: ${OLD_VER} → ${NEW_VER}  (${OLD_REV:0:7} → ${NEW_REV:0:7})"
 
 # -------- .env: REVERB-Werte auf Domain-Basis normalisieren -------------------