diff --git a/docker-compose.yml b/docker-compose.yml
index 6de061a..ad07819 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -98,3 +98,18 @@ services:
       - ./registries.yaml:/etc/rancher/k3s/registries.yaml:ro
     command: server --disable traefik --egress-selector-mode=disabled
     restart: always
+
+  # 5. AUTOMATISCHER KUBECONFIG-SYNCER (DIE BEST-PRACTICE-RETTUNG)
+  sync-kubeconfig:
+    image: alpine:latest
+    container_name: sync-kubeconfig
+    networks:
+      - test-net
+    volumes:
+      - ./kind_kubeconfig:/output:ro
+      - ./sync_kubeconfig.sh:/sync.sh:ro
+    entrypoint: ["/bin/sh", "-c"]
+    command: ["apk add --no-cache curl && /sync.sh"]
+    depends_on:
+      - k3s-cluster
+      - forgejo
diff --git a/kind_kubeconfig/config b/kind_kubeconfig/config
index 3593209..d718f82 100644
--- a/kind_kubeconfig/config
+++ b/kind_kubeconfig/config
@@ -1,7 +1,7 @@
 apiVersion: v1
 clusters:
 - cluster:
-    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJkekNDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdGMyVnkKZG1WeUxXTmhRREUzT1RNME9EZ3hPVEV3SGhjTk1qWXhNRE14TWpNd09UVXhXaGNOTXpZeE1ESTRNak13T1RVeApXakFqTVNFd0h3WURWUVFEREJock0zTXRjMlZ5ZG1WeUxXTmhRREUzT1RNME9EZ3hPVEV3V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFTNVFMeE1MdFFQdXUwb2pWTGtUY3Y5NzRxTnJwWHJQWjg2eVhaSks4WU8KT05mNHdqRUNRdzh0YXowVXZMYVdaNDBHcXBuSnppQW9xMUdyUXV5Z21JK2JvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVStrVWJ2dlkrQ3JYQm5NdkxWa3RaCnQvYlNyZ013Q2dZSUtvWkl6ajBFQXdJRFNBQXdSUUlnUmxjS3VqTitoZWo4MVdwZmJkSnB5eEJydldvRVhUTXYKZVdjdElnMFlEUUVDSVFEVjNzV29YWm82WXo0NC94UHZMamlkNWhnRFNFem5XRkJ4bStoTkp5V1lnZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJkakNDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdGMyVnkKZG1WeUxXTmhRREUzT1RNME9UQXlPVFV3SGhjTk1qWXhNRE14TWpNME5EVTFXaGNOTXpZeE1ESTRNak0wTkRVMQpXakFqTVNFd0h3WURWUVFEREJock0zTXRjMlZ5ZG1WeUxXTmhRREUzT1RNME9UQXlPVFV3V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFTbmxTYkxBeFRzWXZOTktka21ldHBhaG54aGV3ajJPT25ZelZCbjJuRzkKMXB4SlNoS01HbDF2UklmR084M1dvTG1JdExBNEYyaGVHcUsyQVl3c2hpTUhvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTBIbENUYXNkbGFEbmVLNUthM000CitOdXQ1YXN3Q2dZSUtvWkl6ajBFQXdJRFJ3QXdSQUlnUER1MTN1N2Y2TjA0WXpnR3dBM0gxcWZ4enpRS2d2YVoKMFdSNnMxNDBnUmtDSUMxUm5sNWRvbmVMWlFPZTVabG5RVjE0MHMyc3dtSzk4ZXo0TjJqQWJmM1cKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
     server: https://127.0.0.1:6443
   name: default
 contexts:
@@ -15,5 +15,5 @@ preferences: {}
 users:
 - name: default
   user:
-    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrVENDQVRlZ0F3SUJBZ0lJS1NoQlVuVHlsaUF3Q2dZSUtvWkl6ajBFQXdJd0l6RWhNQjhHQTFVRUF3d1kKYXpOekxXTnNhV1Z1ZEMxallVQXhOemt6TkRnNE1Ua3hNQjRYRFRJMk1UQXpNVEl6TURrMU1Wb1hEVEkzTVRBegpNVEl6TURrMU1Wb3dNREVYTUJVR0ExVUVDaE1PYzNsemRHVnRPbTFoYzNSbGNuTXhGVEFUQmdOVkJBTVRESE41CmMzUmxiVHBoWkcxcGJqQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJPejk3SW0ybWFONGhIdDMKQTZpckVwSjZDeFRyUDN1cSs1TllCMCtCWkJXSXNXMkFybUMyajlYSmhsUzV4cVZsVGVmUmZHWW4vVGQ0bkQrSwpDTFNNSVZDalNEQkdNQTRHQTFVZER3RUIvd1FFQXdJRm9EQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0RBakFmCkJnTlZIU01FR0RBV2dCUk52eHFPMjVqNmdyUzNUbXl1d3ZnNzFkZEthREFLQmdncWhrak9QUVFEQWdOSUFEQkYKQWlCQzRjek1qNTUxcVd4M2ZqbUkvT3huRzhUM3BzR3RET2hpdFh0ZGVMNkNsUUloQUlCSE5UWFpYV0xFWjEzNQpXc0lWM0V1RmZobUtZSWc1RGQ5d0JTcFNXdFNjCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJkekNDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdFkyeHAKWlc1MExXTmhRREUzT1RNME9EZ3hPVEV3SGhjTk1qWXhNRE14TWpNd09UVXhXaGNOTXpZeE1ESTRNak13T1RVeApXakFqTVNFd0h3WURWUVFEREJock0zTXRZMnhwWlc1MExXTmhRREUzT1RNME9EZ3hPVEV3V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFSbmUxUWFnamh5Qm9PeHBGbzRNM3RvaGowbStPU2VLc0pDUDMzQjFKWGIKY3JGb1pwTnRneGRNM3BKWVY1OEJJejdpNHRYalB0SE81SzFXY3NDUkpLU1dvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVVRiOGFqdHVZK29LMHQwNXNyc0w0Ck85WFhTbWd3Q2dZSUtvWkl6ajBFQXdJRFNBQXdSUUlnZVFVTDhBTVl1QlZQdFN0WG1LL0dZVFFZVG13SGwyM1oKbEtFSmxDZzBCWjRDSVFEK1l0L1Z0N1RUUkVRQnI2UjlESFNOR0o3MExOQUM3OXpjVTZJalRPRjJvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
-    client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUZhaHNEb0plNjd5NUVBdWMyVXpKNHB2UjVyM2VaSUNKVzh0YjhKVUVXeFJvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFN1Azc2liYVpvM2lFZTNjRHFLc1Nrbm9MRk9zL2U2cjdrMWdIVDRGa0ZZaXhiWUN1WUxhUAoxY21HVkxuR3BXVk41OUY4WmlmOU4zaWNQNG9JdEl3aFVBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrVENDQVRlZ0F3SUJBZ0lJUktjdTNaVStITk13Q2dZSUtvWkl6ajBFQXdJd0l6RWhNQjhHQTFVRUF3d1kKYXpOekxXTnNhV1Z1ZEMxallVQXhOemt6TkRrd01qazFNQjRYRFRJMk1UQXpNVEl6TkRRMU5Wb1hEVEkzTVRBegpNVEl6TkRRMU5Wb3dNREVYTUJVR0ExVUVDaE1PYzNsemRHVnRPbTFoYzNSbGNuTXhGVEFUQmdOVkJBTVRESE41CmMzUmxiVHBoWkcxcGJqQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJFdU9FVEJwV2pGNmwreEwKblcyMnlHcmZZSXdJb0ZwZVN6Tm42M1E1YzNJemRFSUJLV1J1NXp5SG4ydG1oMUJURWNoUVFidkM5ZnRqWWVGNgpxaUpxL0l1alNEQkdNQTRHQTFVZER3RUIvd1FFQXdJRm9EQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0RBakFmCkJnTlZIU01FR0RBV2dCUmV2bHI4ZHFEZFh3ZklPb0gzQUc2Tm9tcTBwREFLQmdncWhrak9QUVFEQWdOSUFEQkYKQWlFQW15V0xlS0hFYmx1NE1TWVpVUWhjTVpibVQwcTk0L2RRUk5LYmRYQUM5VE1DSUNJenlYSS9uZkpadndNWAptay83V0pUdVFMQ0xSaFNtWjRNWUl6emsvcHp1Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdFkyeHAKWlc1MExXTmhRREUzT1RNME9UQXlPVFV3SGhjTk1qWXhNRE14TWpNME5EVTFXaGNOTXpZeE1ESTRNak0wTkRVMQpXakFqTVNFd0h3WURWUVFEREJock0zTXRZMnhwWlc1MExXTmhRREUzT1RNME9UQXlPVFV3V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFUL0w2aU5rbjI4c2lhcm9CVHFQbFR0d1pTZGlrTWlrdDZOV1djUWJGT0oKUEYwUTBjU01IT2JjTjhKZGRtRDNJUmVycldBaHhxa1NId1NyV0pXRmJvMWNvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVVhyNWEvSGFnM1Y4SHlEcUI5d0J1CmphSnF0S1F3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUptWTA3MS8wM0Nqd2JMK1ZtRVRTcFJtcTFvcHJGTHAKSWRMN1A2cm9iYk16QWlFQW95TG1hZjZOTUswU1dDWGFIZUYwa0cwY0g0RndjQk1leE9rUGhKNWh6T3M9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+    client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUJRbnhwZzE5bVN3Q3VoOTZCb0JNTjhTRzRuQ3ZISXlWRnNnZjd3OE1lYldvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFUzQ0Uk1HbGFNWHFYN0V1ZGJiYklhdDlnakFpZ1dsNUxNMmZyZERsemNqTjBRZ0VwWkc3bgpQSWVmYTJhSFVGTVJ5RkJCdThMMSsyTmg0WHFxSW1yOGl3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
diff --git a/sync_kubeconfig.sh b/sync_kubeconfig.sh
new file mode 100755
index 0000000..9409b31
--- /dev/null
+++ b/sync_kubeconfig.sh
@@ -0,0 +1,24 @@
+#!/bin/sh
+echo "Warte auf die frische Kubeconfig von K3s..."
+while [ ! -f /output/config ]; do sleep 1; done
+sleep 2 # Sicherstellen, dass K3s fertig geschrieben hat
+
+echo "Aktualisiere das Forgejo-Secret KUBECONFIG_DATA via API..."
+
+# Liest die Datei ein, maskiert Backslashes und doppelte Anführungszeichen, 
+# und fügt am Ende jeder Zeile ein echtes \n für den JSON-String ein.
+ESCAPED_KUBE=$(awk '{
+  gsub(/\\/, "\\\\");
+  gsub(/"/, "\\\"");
+  printf "%s\\n", $0
+}' /output/config)
+
+# Schiesst das absolut valide JSON-Paket an die Forgejo-API
+curl -s -X PUT "http://forgejo:3000/api/v1/repos/bast/my-app-sandbox/actions/secrets/KUBECONFIG_DATA" \
+  -H "accept: application/json" \
+  -H "Authorization: token eb834b313f4ffe99bc507abc08c46eb74913707a" \
+  -H "Content-Type: application/json" \
+  -d "{\"data\": \"$ESCAPED_KUBE\"}"
+
+echo ""
+echo "Secret erfolgreich synchronisiert!"