diff --git a/ShareExtension/Resources/WordeckShareExtension.entitlements b/ShareExtension/Resources/WordeckShareExtension.entitlements
index 0723c65..95d714b 100644
--- a/ShareExtension/Resources/WordeckShareExtension.entitlements
+++ b/ShareExtension/Resources/WordeckShareExtension.entitlements
@@ -6,5 +6,9 @@
 	<array>
 		<string>group.ev.mana.wordeck</string>
 	</array>
+	<key>keychain-access-groups</key>
+	<array>
+		<string>$(AppIdentifierPrefix)ev.mana.session</string>
+	</array>
 </dict>
 </plist>
diff --git a/Sources/Core/Auth/AppConfig.swift b/Sources/Core/Auth/AppConfig.swift
index e52977e..00de32f 100644
--- a/Sources/Core/Auth/AppConfig.swift
+++ b/Sources/Core/Auth/AppConfig.swift
@@ -7,10 +7,10 @@ import ManaCore
 enum AppConfig {
     static let manaAppConfig: ManaAppConfig = DefaultManaAppConfig(
         authBaseURL: URL(string: "https://auth.mana.how")!,
-        keychainService: "ev.mana.wordeck",
+        keychainService: ManaSharedKeychainGroup,
         // Explizit auf TeamID.BundleID, statt nil. Vermeidet Logout
         // bei TestFlight-Cert-Drift (siehe mana-swift-core v1.5.1).
-        keychainAccessGroup: "QP3GLU8PH3.ev.mana.wordeck",
+        keychainAccessGroup: ManaSharedKeychainGroup,
         // Single-Source fuer den App-Group-String (App-Hülle + Widget
         // + ShareExt-Entitlement spiegeln das hardcoded).
         appGroup: "group.ev.mana.wordeck"
diff --git a/Sources/Resources/WordeckNative.entitlements b/Sources/Resources/WordeckNative.entitlements
index c1ded93..2d1339c 100644
--- a/Sources/Resources/WordeckNative.entitlements
+++ b/Sources/Resources/WordeckNative.entitlements
@@ -18,7 +18,7 @@
 	<true/>
 	<key>keychain-access-groups</key>
 	<array>
-		<string>$(AppIdentifierPrefix)ev.mana.wordeck</string>
+		<string>$(AppIdentifierPrefix)ev.mana.session</string>
 	</array>
 </dict>
 </plist>
diff --git a/Widgets/WordeckWidget/Resources/WordeckWidgetExtension.entitlements b/Widgets/WordeckWidget/Resources/WordeckWidgetExtension.entitlements
index 0723c65..95d714b 100644
--- a/Widgets/WordeckWidget/Resources/WordeckWidgetExtension.entitlements
+++ b/Widgets/WordeckWidget/Resources/WordeckWidgetExtension.entitlements
@@ -6,5 +6,9 @@
 	<array>
 		<string>group.ev.mana.wordeck</string>
 	</array>
+	<key>keychain-access-groups</key>
+	<array>
+		<string>$(AppIdentifierPrefix)ev.mana.session</string>
+	</array>
 </dict>
 </plist>
diff --git a/project.yml b/project.yml
index 9c6123a..c37aad7 100644
--- a/project.yml
+++ b/project.yml
@@ -88,7 +88,7 @@ targets:
         com.apple.security.network.client: true
         com.apple.security.files.user-selected.read-write: true
         keychain-access-groups:
-          - $(AppIdentifierPrefix)ev.mana.wordeck
+          - $(AppIdentifierPrefix)ev.mana.session
         com.apple.developer.associated-domains:
           - applinks:wordeck.com
         com.apple.security.application-groups:
@@ -126,6 +126,8 @@ targets:
     entitlements:
       path: ShareExtension/Resources/WordeckShareExtension.entitlements
       properties:
+        keychain-access-groups:
+          - $(AppIdentifierPrefix)ev.mana.session
         com.apple.security.application-groups:
           - group.ev.mana.wordeck
     settings:
@@ -154,6 +156,8 @@ targets:
     entitlements:
       path: Widgets/WordeckWidget/Resources/WordeckWidgetExtension.entitlements
       properties:
+        keychain-access-groups:
+          - $(AppIdentifierPrefix)ev.mana.session
         com.apple.security.application-groups:
           - group.ev.mana.wordeck
     dependencies: