diff --git a/apps/web/src/lib/api/client.ts b/apps/web/src/lib/api/client.ts
index bccf580..0cc871f 100644
--- a/apps/web/src/lib/api/client.ts
+++ b/apps/web/src/lib/api/client.ts
@@ -10,11 +10,16 @@
  */
 
 import { devUser } from '$lib/auth/dev-stub.svelte.ts';
+import { env as publicEnv } from '$env/dynamic/public';
 
+// `$env/dynamic/public` liest die env zur Runtime aus den ENV-Vars
+// des Node-Servers (adapter-node). Im Browser kommt der Wert aus dem
+// vom Server gerenderten Init-Snapshot, daher gleicher Pfad für SSR
+// und Client. Falls nichts gesetzt → localhost:3081 (Dev-Default).
 export const API_BASE = (() => {
-	if (typeof window !== 'undefined') {
-		return import.meta.env.PUBLIC_CARDS_API_URL ?? 'http://localhost:3081';
-	}
+	const fromPublic = publicEnv.PUBLIC_CARDS_API_URL;
+	if (fromPublic) return fromPublic;
+	if (typeof window !== 'undefined') return 'http://localhost:3081';
 	return process.env.CARDS_API_URL ?? 'http://localhost:3081';
 })();
 
diff --git a/apps/web/src/lib/auth/dev-stub.svelte.ts b/apps/web/src/lib/auth/dev-stub.svelte.ts
index 6df061b..57820c8 100644
--- a/apps/web/src/lib/auth/dev-stub.svelte.ts
+++ b/apps/web/src/lib/auth/dev-stub.svelte.ts
@@ -50,11 +50,11 @@ function isExpired(claims: JwtClaims): boolean {
 	return claims.exp * 1000 < Date.now();
 }
 
+// SvelteKit-konformer ENV-Zugriff (siehe client.ts für Begründung).
+import { env as publicEnv } from '$env/dynamic/public';
+
 function authBaseUrl(): string {
-	if (typeof import.meta !== 'undefined' && import.meta.env?.PUBLIC_MANA_AUTH_URL) {
-		return import.meta.env.PUBLIC_MANA_AUTH_URL;
-	}
-	return 'https://auth.mana.how';
+	return publicEnv.PUBLIC_MANA_AUTH_URL ?? 'https://auth.mana.how';
 }
 
 class Session {
diff --git a/infrastructure/docker-compose.production.yml b/infrastructure/docker-compose.production.yml
index 33986cc..9966957 100644
--- a/infrastructure/docker-compose.production.yml
+++ b/infrastructure/docker-compose.production.yml
@@ -103,11 +103,15 @@ services:
             dockerfile: apps/web/Dockerfile
             args:
                 NPM_AUTH_TOKEN: ${NPM_AUTH_TOKEN:?missing NPM_AUTH_TOKEN}
-                PUBLIC_CARDS_API_URL: https://cardecky-api.mana.how
         restart: unless-stopped
         depends_on:
             - cards-api
         environment:
+            # SvelteKit `$env/dynamic/public` liest zur Runtime — daher
+            # hier statt als Build-Arg. Wert landet im SSR-Init-Snapshot
+            # und in client-fetches.
+            PUBLIC_CARDS_API_URL: https://cardecky-api.mana.how
+            PUBLIC_MANA_AUTH_URL: https://auth.mana.how
             CARDS_API_URL: https://cardecky-api.mana.how
             NODE_ENV: production
         ports: