diff --git a/config/docker/caddy/web-app/Caddyfile b/config/docker/caddy/web-app/Caddyfile
index 72bedcd5..b43886ac 100644
--- a/config/docker/caddy/web-app/Caddyfile
+++ b/config/docker/caddy/web-app/Caddyfile
@@ -17,10 +17,6 @@
 
   encode gzip zstd
 
-  templates {
-    mime text/html application/json
-  }
-
   handle /api/* {
     reverse_proxy api-gateway:8081
   }
diff --git a/config/docker/caddy/web-app/Dockerfile b/config/docker/caddy/web-app/Dockerfile
index 0322d979..3e95041c 100644
--- a/config/docker/caddy/web-app/Dockerfile
+++ b/config/docker/caddy/web-app/Dockerfile
@@ -13,6 +13,9 @@ ARG BUILD_DATE
 # ===================================================================
 FROM caddy:${CADDY_VERSION}
 
+# envsubst für Env-Var-Substitution zur Laufzeit
+RUN apk add --no-cache gettext
+
 ARG VERSION
 ARG BUILD_DATE
 
@@ -21,13 +24,17 @@ LABEL service="web-app" \
       maintainer="Meldestelle Development Team" \
       build.date="${BUILD_DATE}"
 
-# Copy Caddy Config & Templates
+# Copy Caddy Config & Entrypoint
 COPY config/docker/caddy/web-app/Caddyfile /etc/caddy/Caddyfile
 COPY config/docker/caddy/web-app/config.json /usr/share/caddy/config.json
+COPY config/docker/caddy/web-app/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
 
 # Copy Pre-built Static Assets from Host
 # NOTE: You must run `./gradlew :frontend:shells:meldestelle-portal:jsBrowserDistribution -Pproduction=true` locally first!
 COPY frontend/shells/meldestelle-portal/build/dist/js/productionExecutable/ /usr/share/caddy/
+# index.html wird als Template abgelegt; der Entrypoint erzeugt daraus zur Laufzeit die finale index.html
+RUN mv /usr/share/caddy/index.html /usr/share/caddy/index.html.tmpl
 
 # Ensure favicon exists (fallback)
 # Using the shared asset from existing config structure
@@ -38,4 +45,5 @@ EXPOSE 4000
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
     CMD wget --no-verbose --tries=1 --spider http://localhost:4000/health || exit 1
 
+ENTRYPOINT ["/entrypoint.sh"]
 CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
diff --git a/config/docker/caddy/web-app/entrypoint.sh b/config/docker/caddy/web-app/entrypoint.sh
new file mode 100644
index 00000000..5be8a6c5
--- /dev/null
+++ b/config/docker/caddy/web-app/entrypoint.sh
@@ -0,0 +1,10 @@
+#!/bin/sh
+set -e
+
+# Ersetze ${API_BASE_URL} und ${KEYCLOAK_URL} in index.html zur Container-Startzeit.
+# Caddy bekommt eine fertige, statische HTML-Datei — kein Template-Parsing mehr nötig.
+envsubst '${API_BASE_URL} ${KEYCLOAK_URL}' \
+  < /usr/share/caddy/index.html.tmpl \
+  > /usr/share/caddy/index.html
+
+exec "$@"
diff --git a/frontend/shells/meldestelle-portal/src/jsMain/resources/index.html b/frontend/shells/meldestelle-portal/src/jsMain/resources/index.html
index e446e356..cd3d2048 100644
--- a/frontend/shells/meldestelle-portal/src/jsMain/resources/index.html
+++ b/frontend/shells/meldestelle-portal/src/jsMain/resources/index.html
@@ -14,13 +14,13 @@
 </div>
 
 <!--
-  Schritt 1: Caddy füllt dieses JSON-Template aus.
-  Der Inhalt ist reines JSON, was Syntaxkonflikte mit JS vermeidet.
+  Schritt 1: Der Container-Entrypoint ersetzt ${API_BASE_URL} und ${KEYCLOAK_URL}
+  via envsubst beim Start. Caddy bekommt eine fertige statische Datei ohne Template-Parsing.
 -->
 <script id="app-config" type="application/json">
   {
-    "apiBaseUrl": "{{.Env.API_BASE_URL}}",
-    "keycloakUrl": "{{.Env.KEYCLOAK_URL}}"
+    "apiBaseUrl": "${API_BASE_URL}",
+    "keycloakUrl": "${KEYCLOAK_URL}"
   }
 </script>
 
@@ -33,20 +33,20 @@
       const config = JSON.parse(configJson);
       const params = new URLSearchParams(window.location.search);
 
-      const tmplPrefix = '{' + '{'; // Verhindert, dass Caddy '{{' als Template-Action interpretiert
+      const notReplaced = '${'; // Fallback-Erkennung: envsubst hat den Wert NICHT ersetzt
       const apiFromCaddy = config.apiBaseUrl;
       const apiOverride  = params.get('apiBaseUrl');
       globalThis.API_BASE_URL = apiOverride
         ? apiOverride.replace(/\/$/, '')
-        : (apiFromCaddy && !apiFromCaddy.startsWith(tmplPrefix)
+        : (apiFromCaddy && !apiFromCaddy.startsWith(notReplaced)
             ? apiFromCaddy.replace(/\/$/, '')
-            : 'http://' + window.location.origin.replace(/\/$/, ''));
+            : 'http://' + window.location.hostname + ':8081');
 
       const kcFromCaddy = config.keycloakUrl;
       const kcOverride  = params.get('keycloakUrl');
       globalThis.KEYCLOAK_URL = kcOverride
         ? kcOverride.replace(/\/$/, '')
-        : (kcFromCaddy && !kcFromCaddy.startsWith(tmplPrefix)
+        : (kcFromCaddy && !kcFromCaddy.startsWith(notReplaced)
             ? kcFromCaddy.replace(/\/$/, '')
             : 'http://' + window.location.hostname + ':8180');