diff --git a/deploy/install_server.sh b/deploy/install_server.sh
index 4092e99..7f969c4 100755
--- a/deploy/install_server.sh
+++ b/deploy/install_server.sh
@@ -16,21 +16,30 @@ DB_PASSWORD="${DB_PASSWORD:-$(openssl rand -base64 24)}"
 JWT_SECRET_KEY="${JWT_SECRET_KEY:-$(openssl rand -base64 48)}"
 APP_DOMAIN="${APP_DOMAIN:-_}"   # "_" = nginx catch-all, solange keine Domain feststeht
 
+# Kein sudo-Dependency: minimale LXC-Images haben sudo oft nicht vorinstalliert,
+# Skript läuft ohnehin als root (Ausführung dokumentiert das oben).
+# SQL wird bewusst über stdin an psql gepiped statt als su-Argument übergeben –
+# vermeidet doppelte Shell-Quoting-/Word-Splitting-Fallstricke (Bugfix nach Testlauf).
+run_psql() {
+  local db="$1" sql="$2"
+  printf '%s\n' "${sql}" | su -s /bin/bash postgres -c "psql -tA -d '${db}'"
+}
+
 echo "== apt update/install =="
 export DEBIAN_FRONTEND=noninteractive
 apt-get update -qq
 apt-get install -y -qq postgresql nginx python3-venv python3-pip git openssl
 
 echo "== PostgreSQL: Rolle + Datenbank =="
-if ! sudo -u postgres psql -tAc "SELECT 1 FROM pg_roles WHERE rolname='${DB_USER}'" | grep -q 1; then
-  sudo -u postgres psql -c "CREATE ROLE ${DB_USER} WITH LOGIN PASSWORD '${DB_PASSWORD}';"
+if [ "$(run_psql postgres "SELECT 1 FROM pg_roles WHERE rolname='${DB_USER}';")" != "1" ]; then
+  run_psql postgres "CREATE ROLE ${DB_USER} WITH LOGIN PASSWORD '${DB_PASSWORD}';"
   echo "Rolle ${DB_USER} angelegt."
 else
   echo "Rolle ${DB_USER} existiert bereits, überspringe."
 fi
 
-if ! sudo -u postgres psql -tAc "SELECT 1 FROM pg_database WHERE datname='${DB_NAME}'" | grep -q 1; then
-  sudo -u postgres psql -c "CREATE DATABASE ${DB_NAME} OWNER ${DB_USER};"
+if [ "$(run_psql postgres "SELECT 1 FROM pg_database WHERE datname='${DB_NAME}';")" != "1" ]; then
+  run_psql postgres "CREATE DATABASE ${DB_NAME} OWNER ${DB_USER};"
   echo "Datenbank ${DB_NAME} angelegt."
 else
   echo "Datenbank ${DB_NAME} existiert bereits, überspringe."
@@ -38,10 +47,10 @@ fi
 
 # gen_random_uuid() ist seit PG13 built-in, aber pgcrypto schadet nicht und macht es
 # explizit/robust gegen ältere Backports (Review-Fund postgres-expert).
-sudo -u postgres psql -d "${DB_NAME}" -c "CREATE EXTENSION IF NOT EXISTS pgcrypto;"
+run_psql "${DB_NAME}" "CREATE EXTENSION IF NOT EXISTS pgcrypto;"
 
 echo "== PostgreSQL: Speicher-Tuning für kleinen VPS (4GB RAM) =="
-PG_CONF_DIR=$(sudo -u postgres psql -tAc "SHOW config_file;" | xargs dirname)
+PG_CONF_DIR=$(run_psql postgres "SHOW config_file;" | xargs dirname)
 mkdir -p "${PG_CONF_DIR}/conf.d"
 cat > "${PG_CONF_DIR}/conf.d/mabea-tuning.conf" <<'PGCONF'
 # MABEA: konservatives Tuning für ~4GB RAM VPS, nicht enterprise-scale.