diff --git a/Sources/Core/Auth/AppConfig.swift b/Sources/Core/Auth/AppConfig.swift
index 469748b..72094dd 100644
--- a/Sources/Core/Auth/AppConfig.swift
+++ b/Sources/Core/Auth/AppConfig.swift
@@ -10,7 +10,9 @@ enum AppConfig {
     static let manaAppConfig: ManaAppConfig = DefaultManaAppConfig(
         authBaseURL: URL(string: "https://auth.mana.how")!,
         keychainService: "ev.mana.zitare",
-        keychainAccessGroup: nil
+        // Explizit auf TeamID.BundleID, statt nil. Vermeidet Logout
+        // bei TestFlight-Cert-Drift (siehe mana-swift-core v1.5.1).
+        keychainAccessGroup: "QP3GLU8PH3.ev.mana.zitare"
     )
 
     /// `zitare-api.mana.how` — API-Backend (Hono+Bun).