diff --git a/deploy/rollout-131-provision-secrets.sh b/deploy/rollout-131-provision-secrets.sh
new file mode 100755
index 00000000..8ada0958
--- /dev/null
+++ b/deploy/rollout-131-provision-secrets.sh
@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+# Einrichtungsskript fuer die verbleibenden Secret-Werte des 131-Rollouts.
+# Fuehrt selbst KEIN systemctl aus -- nur DB-Rolle/DB anlegen und die
+# KEK-Client-Registrierung gegen die Core-Registry-DB ausfuehren.
+#
+# Nutzung (als root auf 131, im Repo-Checkout, z.B. /root/nexarch-code):
+#   ./deploy/rollout-131-provision-secrets.sh
+#
+# Voraussetzung: /etc/nexarch/connect-app.env und /etc/nexarch/dms-app.env
+# existieren bereits (aus rollout-131-sync.sh).
+set -euo pipefail
+
+CONNECT_ENV=/etc/nexarch/connect-app.env
+DMS_ENV=/etc/nexarch/dms-app.env
+CORE_ENV=/etc/nexarch/core.env
+
+if [ ! -f "$CONNECT_ENV" ] || [ ! -f "$DMS_ENV" ] || [ ! -f "$CORE_ENV" ]; then
+	echo "Abbruch: eine der Env-Dateien fehlt ($CONNECT_ENV, $DMS_ENV, $CORE_ENV)." >&2
+	exit 1
+fi
+
+echo "== 1. Connect-DB (Rolle + Datenbank) =="
+if grep -q '^NEXARCH_CONNECT_APP_TENANT_DSN=.*TODO' "$CONNECT_ENV" 2>/dev/null || ! grep -q '^NEXARCH_CONNECT_APP_TENANT_DSN=' "$CONNECT_ENV"; then
+	PW=$(openssl rand -hex 20)
+	sudo -u postgres psql -v ON_ERROR_STOP=1 <<SQL
+DO \$\$
+BEGIN
+	IF EXISTS (SELECT FROM pg_roles WHERE rolname = 'connect_app') THEN
+		ALTER ROLE connect_app WITH PASSWORD '${PW}';
+	ELSE
+		CREATE ROLE connect_app LOGIN PASSWORD '${PW}';
+	END IF;
+END
+\$\$;
+SELECT 'CREATE DATABASE connect_app_tenant OWNER connect_app'
+WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'connect_app_tenant')\gexec
+SQL
+	sed -i '/^NEXARCH_CONNECT_APP_TENANT_DSN=/d' "$CONNECT_ENV"
+	echo "NEXARCH_CONNECT_APP_TENANT_DSN=postgresql://connect_app:${PW}@localhost:5432/connect_app_tenant?sslmode=disable" >> "$CONNECT_ENV"
+	echo "OK: NEXARCH_CONNECT_APP_TENANT_DSN gesetzt."
+else
+	echo "Uebersprungen: NEXARCH_CONNECT_APP_TENANT_DSN ist schon gesetzt."
+fi
+
+if grep -q '^NEXARCH_CONNECT_APP_LISTEN_ADDR=.*TODO' "$CONNECT_ENV" 2>/dev/null || ! grep -q '^NEXARCH_CONNECT_APP_LISTEN_ADDR=' "$CONNECT_ENV"; then
+	sed -i '/^NEXARCH_CONNECT_APP_LISTEN_ADDR=/d' "$CONNECT_ENV"
+	echo "NEXARCH_CONNECT_APP_LISTEN_ADDR=127.0.0.1:9500" >> "$CONNECT_ENV"
+	echo "OK: NEXARCH_CONNECT_APP_LISTEN_ADDR gesetzt (127.0.0.1:9500)."
+else
+	echo "Uebersprungen: NEXARCH_CONNECT_APP_LISTEN_ADDR ist schon gesetzt."
+fi
+
+echo
+echo "== 2. KEK-Client fuer DMS registrieren =="
+if grep -q '^NEXARCH_DMS_APP_KEK_CLIENT_ID=.*TODO' "$DMS_ENV" 2>/dev/null; then
+	REGISTRY_DSN=$(grep '^NEXARCH_REGISTRY_DSN=' "$CORE_ENV" | cut -d= -f2-)
+	if [ -z "$REGISTRY_DSN" ]; then
+		echo "Abbruch: NEXARCH_REGISTRY_DSN nicht in $CORE_ENV gefunden." >&2
+		exit 1
+	fi
+	REPO_ROOT=$(cd "$(dirname "$0")/.." && pwd)
+	PROVISION_DIR="$REPO_ROOT/cmd/provision-dms-kek"
+	mkdir -p "$PROVISION_DIR"
+	cat > "$PROVISION_DIR/main.go" <<'EOF'
+package main
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+	"gitea.perlbach24.de/scripte/nexarch/internal/moduleregistry"
+)
+
+const envFile = "/etc/nexarch/dms-app.env"
+
+func main() {
+	pool, err := pgxpool.New(context.Background(), os.Getenv("CORE_ADMIN_DSN"))
+	if err != nil {
+		panic(err)
+	}
+	defer pool.Close()
+	reg := moduleregistry.NewRegistry(pool, nil)
+	if _, err := reg.Get(context.Background(), "dms"); err != nil {
+		if _, err := reg.Register(context.Background(), "dms", "1", nil); err != nil {
+			panic(err)
+		}
+	}
+	clientID, secret, err := reg.Provision(context.Background(), "dms")
+	if err != nil {
+		panic(err)
+	}
+
+	raw, err := os.ReadFile(envFile)
+	if err != nil {
+		panic(err)
+	}
+	var kept []string
+	sc := bufio.NewScanner(strings.NewReader(string(raw)))
+	for sc.Scan() {
+		line := sc.Text()
+		if strings.HasPrefix(line, "NEXARCH_DMS_APP_KEK_CLIENT_ID=") || strings.HasPrefix(line, "NEXARCH_DMS_APP_KEK_CLIENT_SECRET=") {
+			continue
+		}
+		kept = append(kept, line)
+	}
+	kept = append(kept, "NEXARCH_DMS_APP_KEK_CLIENT_ID="+clientID)
+	kept = append(kept, "NEXARCH_DMS_APP_KEK_CLIENT_SECRET="+secret)
+	if err := os.WriteFile(envFile, []byte(strings.Join(kept, "\n")+"\n"), 0600); err != nil {
+		panic(err)
+	}
+	fmt.Println("OK: KEK-Client-ID/-Secret geschrieben.")
+}
+EOF
+	(cd "$REPO_ROOT" && CORE_ADMIN_DSN="$REGISTRY_DSN" go run ./cmd/provision-dms-kek)
+	rm -rf "$PROVISION_DIR"
+else
+	echo "Uebersprungen: NEXARCH_DMS_APP_KEK_CLIENT_ID ist schon gesetzt."
+fi
+
+echo
+echo "== 3. Core-Service-Token fuer DMS (INT-14) =="
+if grep -q '^NEXARCH_DMS_APP_CORE_SERVICE_TOKEN=.*TODO' "$DMS_ENV" 2>/dev/null; then
+	echo "OFFEN: kein passender Core-Endpunkt vorhanden (echte Code-Luecke, kein Konfigurationsproblem)."
+	echo "       DMS ruft GET /tenants/{slug} mit X-Service-Token auf, Core registriert diese Route nirgends."
+	echo "       Muss erst durch ein eigenes Ticket (Core-seitiger Endpunkt) geschlossen werden."
+else
+	echo "Uebersprungen: NEXARCH_DMS_APP_CORE_SERVICE_TOKEN ist schon gesetzt."
+fi
+
+echo
+echo "== Zusammenfassung =="
+grep -c TODO "$CONNECT_ENV" | xargs -I{} echo "connect-app.env: {} offene TODOs"
+grep -c TODO "$DMS_ENV" | xargs -I{} echo "dms-app.env: {} offene TODOs"