diff --git a/backend/src/db.js b/backend/src/db.js
index 3098b88..4dca2e0 100644
--- a/backend/src/db.js
+++ b/backend/src/db.js
@@ -178,6 +178,13 @@ if (!oiCols.includes('qty_fertig'))      db.exec("ALTER TABLE order_items ADD CO
 // Bestehende Einträge: alle Stücke auf Warteliste setzen falls noch keine Qtys gesetzt
 db.exec("UPDATE order_items SET qty_warteliste=stueckzahl WHERE qty_warteliste=0 AND qty_in_arbeit=0 AND qty_fertig=0");
 
+// Migration: file_shares – Passwort und Zugriffszeit
+const fShareCols = db.prepare("PRAGMA table_info(file_shares)").all().map(r => r.name);
+if (fShareCols.length && !fShareCols.includes('password_hash'))
+  db.exec("ALTER TABLE file_shares ADD COLUMN password_hash TEXT DEFAULT NULL");
+if (fShareCols.length && !fShareCols.includes('accessed_at'))
+  db.exec("ALTER TABLE file_shares ADD COLUMN accessed_at DATETIME DEFAULT NULL");
+
 // ── Nachrichten-Migrationen ───────────────────────────────────────────────────
 if (!db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='messages'").get()) {
   db.exec(`