diff --git a/backend/app/services/caldav_service.py b/backend/app/services/caldav_service.py
index 3c22cfd..4d84ee4 100644
--- a/backend/app/services/caldav_service.py
+++ b/backend/app/services/caldav_service.py
@@ -34,9 +34,10 @@ log = logging.getLogger(__name__)
 # ── Crypto (shared with SMTP/LDAP) ────────────────────────────────────────────
 
 def _fernet():
+    # K-5: zentraler Datenschlüssel (nutzt SECRET_KEY_DATA wenn gesetzt, sonst SECRET_KEY).
     from cryptography.fernet import Fernet
-    key = hashlib.sha256(settings.secret_key.encode()).digest()
-    return Fernet(base64.urlsafe_b64encode(key))
+    from app.core.crypto import get_fernet_key
+    return Fernet(get_fernet_key())
 
 
 def encrypt_password(plain: str) -> str:
diff --git a/backend/app/services/email_service.py b/backend/app/services/email_service.py
index 9eb2532..aec291c 100644
--- a/backend/app/services/email_service.py
+++ b/backend/app/services/email_service.py
@@ -44,13 +44,9 @@ def _html_wrapper(title: str, body: str) -> str:
 
 
 def _decrypt_password(encrypted: str) -> str:
-    """Fernet-Entschlüsselung (gleiche Implementierung wie ldap_service)."""
-    import base64
-    import hashlib
-    from cryptography.fernet import Fernet
-    key = hashlib.sha256(settings.secret_key.encode()).digest()
-    f = Fernet(base64.urlsafe_b64encode(key))
-    return f.decrypt(encrypted.encode()).decode()
+    """Fernet-Entschlüsselung über den zentralen Datenschlüssel (K-5)."""
+    from app.core.crypto import decrypt_value
+    return decrypt_value(encrypted)
 
 
 def _smtp_send_sync(cfg: SmtpConfig, to: str, subject: str, html: str) -> None:
diff --git a/backend/app/services/ldap_service.py b/backend/app/services/ldap_service.py
index 4b1750e..947722d 100644
--- a/backend/app/services/ldap_service.py
+++ b/backend/app/services/ldap_service.py
@@ -23,9 +23,10 @@ logger = logging.getLogger(__name__)
 
 
 def _fernet():
+    # K-5: zentraler Datenschlüssel (nutzt SECRET_KEY_DATA wenn gesetzt, sonst SECRET_KEY).
     from cryptography.fernet import Fernet
-    key = hashlib.sha256(settings.secret_key.encode()).digest()
-    return Fernet(base64.urlsafe_b64encode(key))
+    from app.core.crypto import get_fernet_key
+    return Fernet(get_fernet_key())
 
 
 def encrypt_password(plain: str) -> str: