diff --git a/scripts/authentik-setup.py b/scripts/authentik-setup.py
index 0f44565..3b1fd65 100644
--- a/scripts/authentik-setup.py
+++ b/scripts/authentik-setup.py
@@ -148,7 +148,6 @@ def ensure_service_account(groups):
         print(f"  = Service-Account '{SERVICE_ACCOUNT}' vorhanden")
     else:
         res = call("POST", "/core/users/service_account/", {"name": SERVICE_ACCOUNT, "create_group": False, "expiring": False})
-        token_key = res.get("token")
         user = {"pk": res.get("user_pk")}
         print(f"  + Service-Account '{SERVICE_ACCOUNT}' angelegt")
 
@@ -170,15 +169,27 @@ def ensure_service_account(groups):
     else:
         print(f"  = Gruppe '{SERVICE_GROUP}' vorhanden")
 
-    if not token_key and APPLY:
-        tokens = [t for t in results(f"/core/tokens/?user__username={SERVICE_ACCOUNT}") if t["intent"] == "api"]
-        if tokens:
-            token_key = call("GET", f"/core/tokens/{tokens[0]['identifier']}/view_key/")["key"]
+    # Der Service-Account bekommt von Authentik nur ein App-Passwort (intent=app_password),
+    # das die API nicht als Bearer-Token akzeptiert. Deshalb eigener API-Token.
+    if APPLY and user.get("pk"):
+        ident = f"{SERVICE_ACCOUNT}-api"
+        if not results(f"/core/tokens/?identifier={ident}"):
+            call("POST", "/core/tokens/", {
+                "identifier": ident, "user": user["pk"], "intent": "api", "expiring": False,
+                "description": "Portal: App-Liste pro Benutzer lesen",
+            })
+            print(f"  + API-Token '{ident}' angelegt")
+        token_key = call("GET", f"/core/tokens/{ident}/view_key/")["key"]
     return user, token_key
 
 
 def branding():
     step("4. Branding")
+    try:
+        urllib.request.urlopen(f"{PORTAL_URL}/icon-192.png", timeout=10)
+    except Exception:
+        print(f"  - übersprungen: {PORTAL_URL} ist noch nicht erreichbar (sonst kaputtes Logo auf der Login-Seite)")
+        return
     brand = next((b for b in results("/core/brands/") if b.get("default")), None) or results("/core/brands/")[0]
     call("PATCH", f"/core/brands/{brand['brand_uuid']}/", {
         "branding_title": "Handy-Insel",