diff --git a/deploy/131-portal-einrichten.sh b/deploy/131-portal-einrichten.sh
index 67544f7c..c7281fcc 100755
--- a/deploy/131-portal-einrichten.sh
+++ b/deploy/131-portal-einrichten.sh
@@ -142,12 +142,20 @@ build_app() { # build_app <verzeichnis-mit-web/> <app> <env...>
   rsync -a --delete --exclude node_modules --exclude .next "$SRC/web/shl/" "$base/web/shl/"
   rsync -a --delete --exclude node_modules --exclude .next "$SRC/web/$app/" "$dir/"
   chown -R nexarch:nexarch "$base/web/shl" "$dir"
+  mkdir -p "$base/.home"; chown nexarch:nexarch "$base/.home"
+  local lock; lock=$(sha256sum "$dir/package-lock.json" | cut -d' ' -f1)
+  if [ ! -d "$dir/node_modules" ] || [ "$(cat "$dir/node_modules/.nexarch-lock" 2>/dev/null)" != "$lock" ]; then
+    runuser -u nexarch -- env HOME="$base/.home" NPM_CONFIG_CACHE="$base/.home/.npm" bash -c "cd '$dir' && npm ci --no-audit --no-fund && echo $lock > node_modules/.nexarch-lock" </dev/null > "$BAK/$app-npm.log" 2>&1 \
+      || { tail -5 "$BAK/$app-npm.log"; fail "npm ci $app fehlgeschlagen (Log: $BAK/$app-npm.log)"; }
+  fi
   if [ -d "$dir/node_modules/@nexarch/shl" ] && [ ! -L "$dir/node_modules/@nexarch/shl" ]; then
     rm -rf "$dir/node_modules/@nexarch/shl"; ln -s ../../../shl "$dir/node_modules/@nexarch/shl"
   fi
+  if [ -e "$base/web/shl/node_modules" ] && [ ! -L "$base/web/shl/node_modules" ]; then
+    mv "$base/web/shl/node_modules" "$BAK/$app-shl-node_modules"
+  fi
   [ -e "$base/web/shl/node_modules" ] || ln -s "../$app/node_modules" "$base/web/shl/node_modules"
-  mkdir -p "$base/.home"; chown nexarch:nexarch "$base/.home"
-  if runuser -u nexarch -- env HOME="$base/.home" NPM_CONFIG_CACHE="$base/.home/.npm" "$@" bash -c "cd '$dir' && { [ -d node_modules ] || npm ci --no-audit --no-fund; } && npx next build --webpack" </dev/null > "$BAK/$app-build.log" 2>&1; then
+  if runuser -u nexarch -- env HOME="$base/.home" NPM_CONFIG_CACHE="$base/.home/.npm" "$@" bash -c "cd '$dir' && npx next build --webpack" </dev/null > "$BAK/$app-build.log" 2>&1; then
     echo "Build $app ok"
   else
     tail -5 "$BAK/$app-build.log"