diff --git a/.gitea/workflows/update.yml b/.gitea/workflows/update.yml
index 513eea4a91..df701cbfce 100644
--- a/.gitea/workflows/update.yml
+++ b/.gitea/workflows/update.yml
@@ -25,7 +25,7 @@ jobs:
         run: |
           set -Eeuo pipefail
           umask 077
-          : "${GITEA_JOB_TOKEN:?GITEA_TOKEN fehlt}"
+          : "${GITEA_JOB_TOKEN:?GITEATOKEN fehlt}"
           mkdir -p "$CACHE_ROOT"
           exec 9>"$CACHE_ROOT/.sync.lock"
           flock -w 300 9 || { echo "Bereits ein Lauf aktiv" >&2; exit 1; }
@@ -42,24 +42,57 @@ jobs:
           ASKPASS_SCRIPT
           chmod 700 "$ASKPASS"
           export GIT_ASKPASS="$ASKPASS" GIT_TERMINAL_PROMPT=0
+
           REMOTE="https://git.apex-project.de/VULN/vuln-osv.git"
           REPO="$CACHE_ROOT/repo"
+
+          backup_repo() {
+            mkdir -p "$CACHE_ROOT/backups"
+            local backup="$CACHE_ROOT/backups/repo.$(date -u +%Y%m%dT%H%M%SZ).$$"
+            echo "Repository-Cache wird gesichert: $backup"
+            mv -- "$REPO" "$backup"
+          }
+
+          clone_repo() {
+            git -c credential.helper= clone \
+              --branch main --single-branch --depth 1 \
+              "$REMOTE" "$REPO"
+          }
+
           if [ ! -d "$REPO/.git" ]; then
-            [ ! -e "$REPO" ] || { echo "Unvollstaendiger Cache: $REPO" >&2; exit 1; }
-            git -c credential.helper= clone --branch main --single-branch --depth 1 "$REMOTE" "$REPO"
-          else
-            # Never reset an unfinished local commit or changes after a failed push.
-            if [ -n "$(git -C "$REPO" status --porcelain)" ] || [ "$(git -C "$REPO" rev-list --count origin/main..HEAD)" != 0 ]; then
-              echo "Lokale Aenderungen/Commits vorhanden: manuell pruefen, nicht ueberschreiben" >&2
-              exit 1
+            if [ -e "$REPO" ]; then
+              backup_repo
             fi
+            clone_repo
+          else
+            # Den Tracking-Stand VOR dem Fetch merken: bei shallow clones
+            # ist ein reiner rev-list-Vergleich NACH dem Fetch unzuverlaessig.
+            OLD_REMOTE_HEAD="$(git -C "$REPO" rev-parse -q --verify refs/remotes/origin/main 2>/dev/null || true)"
+            LOCAL_HEAD="$(git -C "$REPO" rev-parse -q --verify HEAD 2>/dev/null || true)"
+            LOCAL_STATUS="$(git -C "$REPO" status --porcelain)"
+
             git -C "$REPO" remote set-url origin "$REMOTE"
             git -C "$REPO" -c credential.helper= fetch --no-tags --depth 1 origin main
-            git -C "$REPO" checkout -B main FETCH_HEAD
+            NEW_REMOTE_HEAD="$(git -C "$REPO" rev-parse FETCH_HEAD)"
+
+            if [ -n "$LOCAL_STATUS" ]; then
+              echo "Lokale Aenderungen gefunden; sichere Repository-Cache."
+              backup_repo
+              clone_repo
+            elif [ "$LOCAL_HEAD" = "$OLD_REMOTE_HEAD" ] || [ "$LOCAL_HEAD" = "$NEW_REMOTE_HEAD" ]; then
+              # Keine ausstehenden lokalen Commits: Aktualisierung ist sicher.
+              git -C "$REPO" checkout -B main "$NEW_REMOTE_HEAD"
+            else
+              echo "Moeglicherweise ungepushte lokale Commits; sichere Repository-Cache."
+              backup_repo
+              clone_repo
+            fi
           fi
+
           cd "$REPO"
           python3 scripts/sync.py
           python3 scripts/validate.py
+
           git config user.name "Vulnerability Bot"
           git config user.email "vuln-bot@users.noreply.local"
           git add -A -- data/ state/
@@ -67,5 +100,7 @@ jobs:
             echo "Keine neuen Daten"
             exit 0
           fi
+
           git commit -m "vuln-osv update $(date -u +%Y-%m-%dT%H:%M:%SZ)"
           git -c credential.helper= push origin HEAD:main
+