diff --git a/src/lib/admin-auth.ts b/src/lib/admin-auth.ts
index f14ffbb..38011cb 100644
--- a/src/lib/admin-auth.ts
+++ b/src/lib/admin-auth.ts
@@ -11,7 +11,11 @@ import { getAuth } from "./auth";
 export type AdminUser = { id: string; email: string; name: string; twoFactorEnabled: boolean };
 
 async function currentAdmin(): Promise<AdminUser | null> {
-  const session = await getAuth().api.getSession({ headers: await headers() });
+  // Zuerst die Request-Header lesen: das macht jede Admin-Route dynamisch.
+  // Sonst versucht "next build" sie vorab zu rendern und scheitert ohne
+  // Secrets im Container (getAuth() braucht BETTER_AUTH_SECRET).
+  const requestHeaders = await headers();
+  const session = await getAuth().api.getSession({ headers: requestHeaders });
   if (!session) return null;
   const user = session.user as typeof session.user & { twoFactorEnabled?: boolean | null };
   return { id: user.id, email: user.email, name: user.name, twoFactorEnabled: Boolean(user.twoFactorEnabled) };