diff --git a/CHANGELOG.md b/CHANGELOG.md
index e7fd4f5..3a14620 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,15 @@
 
 All notable changes to this project are documented in this file.
 
+## [1.114.1] - 2026-09-01
+
+### Added
+- `scripts/update-app.sh`: the production deploy script, now version-controlled instead of
+  living only on the server. Hardened with `set -euo pipefail` (a failed `git pull` used to
+  still trigger a rebuild and PM2 restart on unchanged code) and switched from `npm install`
+  to `npm ci` (npm install rewrote package-lock.json, leaving the tree dirty so the next
+  pull aborted).
+
 ## [1.114.0] - 2026-09-01
 
 ### Added
diff --git a/package-lock.json b/package-lock.json
index 503c0c3..4201f0d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "my-weekly-todo-list",
-  "version": "1.114.0",
+  "version": "1.114.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "my-weekly-todo-list",
-      "version": "1.114.0",
+      "version": "1.114.1",
       "license": "MIT",
       "dependencies": {
         "@auth/prisma-adapter": "^2.11.1",
diff --git a/package.json b/package.json
index 0068536..cf70348 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "my-weekly-todo-list",
-  "version": "1.114.0",
+  "version": "1.114.1",
   "description": "A web-based weekly task management application that organizes to-dos and calendar events in a single, intuitive weekly view",
   "main": "index.js",
   "scripts": {
diff --git a/scripts/update-app.sh b/scripts/update-app.sh
new file mode 100644
index 0000000..3785ee8
--- /dev/null
+++ b/scripts/update-app.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+#
+# Deploy script for the production host (WebApp-Testing-live).
+#
+# The app runs there as a PM2 process ("my-weekly-todo") from /root/My-Weekly-ToDo-List.
+# It is NOT run under Docker — deploy.sh and docker-compose.yml in this repo describe an
+# older Portainer setup that is not what serves todo.martin-bierschenk.de.
+#
+# Usage on the host:  /root/My-Weekly-ToDo-List/scripts/update-app.sh
+#
+# The whole body is wrapped in a function so bash parses it in one go: this script lives
+# inside the very checkout it updates, and `git pull` rewriting it mid-run would otherwise
+# make bash resume at a stale file offset.
+
+main() {
+    set -euo pipefail
+
+    # Fail fast instead of hanging on a credential prompt when run without a terminal
+    # (e.g. from systemd). The host authenticates via a read-only SSH deploy key.
+    export GIT_TERMINAL_PROMPT=0
+
+    local APP_DIR="/root/My-Weekly-ToDo-List"
+    local PM2_APP="my-weekly-todo"
+
+    cd "$APP_DIR"
+
+    echo "--- Pulling latest changes from git ---"
+    git pull origin main
+
+    # npm ci, not npm install: it installs exactly what package-lock.json specifies and
+    # never rewrites it. npm install rewrites the lockfile, which leaves the working tree
+    # dirty and makes the *next* git pull abort.
+    echo "--- Installing dependencies ---"
+    npm ci
+
+    echo "--- Building application ---"
+    npm run build
+
+    echo "--- Restarting PM2 process ---"
+    pm2 restart "$PM2_APP" --update-env
+    pm2 save
+
+    echo "--- Update Complete ---"
+    echo "Deployed version: $(node -p "require('$APP_DIR/package.json').version")"
+}
+
+main "$@"