diff --git a/scripts/update.sh b/scripts/update.sh
index 22cd212..c64e301 100644
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -282,6 +282,64 @@ UNIT
     systemctl stop    clamav-daemon    2>/dev/null || true
     echo "[✓] ClamAV installiert (deaktiviert – User kann es einschalten)."
   fi
+
+  # Fail2Ban: Jails + Sudoers sicherstellen (idempotent)
+  local F2B_SUDO="/etc/sudoers.d/mailwolt-fail2ban"
+  local F2B_JAIL="/etc/fail2ban/jail.d/mailwolt-jails.local"
+  if command -v fail2ban-client >/dev/null 2>&1; then
+    # Sudoers für www-data
+    if [[ ! -f "$F2B_SUDO" ]]; then
+      cat > "$F2B_SUDO" << 'SUDOEOF'
+www-data ALL=(root) NOPASSWD: /usr/bin/tee /etc/fail2ban/jail.d/00-defaults.local
+www-data ALL=(root) NOPASSWD: /usr/bin/tee /etc/fail2ban/jail.d/whitelist.local
+www-data ALL=(root) NOPASSWD: /usr/bin/fail2ban-client reload
+www-data ALL=(root) NOPASSWD: /usr/bin/fail2ban-client status
+www-data ALL=(root) NOPASSWD: /usr/bin/fail2ban-client status *
+www-data ALL=(root) NOPASSWD: /usr/bin/fail2ban-client set * banip *
+www-data ALL=(root) NOPASSWD: /usr/bin/fail2ban-client set * unbanip *
+SUDOEOF
+      chmod 440 "$F2B_SUDO"
+      echo "[✓] Fail2Ban sudoers installiert."
+    fi
+    # Jail-Konfiguration (dovecot, postfix, nginx)
+    if [[ ! -f "$F2B_JAIL" ]]; then
+      cat > "$F2B_JAIL" << 'JAILEOF'
+[dovecot]
+enabled  = true
+port     = pop3,pop3s,imap,imaps,submission,submissions,sieve
+filter   = dovecot
+logpath  = /var/log/mail.log
+maxretry = 5
+
+[postfix]
+enabled  = true
+port     = smtp,465,submission,submissions
+filter   = postfix[mode=more]
+logpath  = /var/log/mail.log
+maxretry = 5
+
+[nginx-http-auth]
+enabled  = true
+port     = http,https
+filter   = nginx-http-auth
+logpath  = /var/log/nginx/error.log
+           /var/log/nginx/mailwolt_error.log
+           /var/log/nginx/mailwolt_ssl_error.log
+maxretry = 5
+
+[nginx-botsearch]
+enabled  = true
+port     = http,https
+filter   = nginx-botsearch
+logpath  = /var/log/nginx/access.log
+           /var/log/nginx/mailwolt_access.log
+           /var/log/nginx/mailwolt_ssl_access.log
+maxretry = 2
+JAILEOF
+      systemctl is-active --quiet fail2ban && fail2ban-client reload >/dev/null 2>&1 || true
+      echo "[✓] Fail2Ban Jails installiert (dovecot, postfix, nginx)."
+    fi
+  fi
 }
 
 # -------- Guards --------------------------------------------------------------