diff --git a/.turbo/cache/083c8105a3916fd9-manifest.json b/.turbo/cache/083c8105a3916fd9-manifest.json
index bccbee3..7d44242 100644
--- a/.turbo/cache/083c8105a3916fd9-manifest.json
+++ b/.turbo/cache/083c8105a3916fd9-manifest.json
@@ -1 +1 @@
-{"files":{"packages/auth/dist/username.d.ts":{"size":442,"mtime_nanos":1783255151494048909,"mode":420,"is_dir":false},"packages/auth/dist/recovery-codes.js":{"size":1089,"mtime_nanos":1783255151493710470,"mode":420,"is_dir":false},"packages/auth/dist/tokens.d.ts.map":{"size":281,"mtime_nanos":1783255151493885819,"mode":420,"is_dir":false},"packages/auth/dist/username.d.ts.map":{"size":430,"mtime_nanos":1783255151494073119,"mode":420,"is_dir":false},"packages/auth/dist/password.d.ts":{"size":200,"mtime_nanos":1783255151493536190,"mode":420,"is_dir":false},"packages/auth/dist/recovery-codes.d.ts.map":{"size":306,"mtime_nanos":1783255151493686290,"mode":420,"is_dir":false},"packages/auth/dist/password.d.ts.map":{"size":266,"mtime_nanos":1783255151493572620,"mode":420,"is_dir":false},"packages/auth/.turbo/turbo-build.log":{"size":102,"mtime_nanos":1783255052127378550,"mode":420,"is_dir":false},"packages/auth/dist/session.js":{"size":672,"mtime_nanos":1783255151493811820,"mode":420,"is_dir":false},"packages/auth/dist/totp.d.ts.map":{"size":303,"mtime_nanos":1783255151493978659,"mode":420,"is_dir":false},"packages/auth/dist/index.js.map":{"size":824,"mtime_nanos":1783255151493485050,"mode":420,"is_dir":false},"packages/auth/dist/totp.js.map":{"size":569,"mtime_nanos":1783255151494024989,"mode":420,"is_dir":false},"packages/auth/dist/username.js":{"size":2787,"mtime_nanos":1783255151494096559,"mode":420,"is_dir":false},"packages/auth/dist/session.d.ts.map":{"size":300,"mtime_nanos":1783255151493784580,"mode":420,"is_dir":false},"packages/auth/dist/index.d.ts":{"size":1570,"mtime_nanos":1783255151493314190,"mode":420,"is_dir":false},"packages/auth/dist/index.d.ts.map":{"size":1443,"mtime_nanos":1783255151493364820,"mode":420,"is_dir":false},"packages/auth/dist/tokens.js.map":{"size":760,"mtime_nanos":1783255151493932809,"mode":420,"is_dir":false},"packages/auth/dist/totp.d.ts":{"size":269,"mtime_nanos":1783255151493955819,"mode":420,"is_dir":false},"packages/auth/dist/index.js":{"size":4135,"mtime_nanos":1783255151493407900,"mode":420,"is_dir":false},"packages/auth/dist/recovery-codes.js.map":{"size":949,"mtime_nanos":1783255151493735800,"mode":420,"is_dir":false},"packages/auth/dist/tokens.d.ts":{"size":244,"mtime_nanos":1783255151493861049,"mode":420,"is_dir":false},"packages/auth/dist/totp.js":{"size":683,"mtime_nanos":1783255151494002079,"mode":420,"is_dir":false},"packages/auth/dist/username.js.map":{"size":2294,"mtime_nanos":1783255151494119969,"mode":420,"is_dir":false},"packages/auth/dist/tokens.js":{"size":864,"mtime_nanos":1783255151493909599,"mode":420,"is_dir":false},"packages/auth/dist/session.js.map":{"size":493,"mtime_nanos":1783255151493836729,"mode":420,"is_dir":false},"packages/auth/dist/password.js":{"size":482,"mtime_nanos":1783255151493603670,"mode":420,"is_dir":false},"packages/auth/dist/password.js.map":{"size":404,"mtime_nanos":1783255151493633310,"mode":420,"is_dir":false},"packages/auth/dist/recovery-codes.d.ts":{"size":264,"mtime_nanos":1783255151493659970,"mode":420,"is_dir":false},"packages/auth/dist/session.d.ts":{"size":334,"mtime_nanos":1783255151493759480,"mode":420,"is_dir":false}},"order":["packages/auth/.turbo/turbo-build.log","packages/auth/dist/index.d.ts","packages/auth/dist/index.d.ts.map","packages/auth/dist/index.js","packages/auth/dist/index.js.map","packages/auth/dist/password.d.ts","packages/auth/dist/password.d.ts.map","packages/auth/dist/password.js","packages/auth/dist/password.js.map","packages/auth/dist/recovery-codes.d.ts","packages/auth/dist/recovery-codes.d.ts.map","packages/auth/dist/recovery-codes.js","packages/auth/dist/recovery-codes.js.map","packages/auth/dist/session.d.ts","packages/auth/dist/session.d.ts.map","packages/auth/dist/session.js","packages/auth/dist/session.js.map","packages/auth/dist/tokens.d.ts","packages/auth/dist/tokens.d.ts.map","packages/auth/dist/tokens.js","packages/auth/dist/tokens.js.map","packages/auth/dist/totp.d.ts","packages/auth/dist/totp.d.ts.map","packages/auth/dist/totp.js","packages/auth/dist/totp.js.map","packages/auth/dist/username.d.ts","packages/auth/dist/username.d.ts.map","packages/auth/dist/username.js","packages/auth/dist/username.js.map"]}
\ No newline at end of file
+{"files":{"packages/auth/.turbo/turbo-build.log":{"size":102,"mtime_nanos":1783255052127378550,"mode":420,"is_dir":false},"packages/auth/dist/password.d.ts":{"size":200,"mtime_nanos":1783255318234684822,"mode":420,"is_dir":false},"packages/auth/dist/totp.js":{"size":683,"mtime_nanos":1783255318235066252,"mode":420,"is_dir":false},"packages/auth/dist/totp.d.ts":{"size":269,"mtime_nanos":1783255318235033232,"mode":420,"is_dir":false},"packages/auth/dist/session.js":{"size":672,"mtime_nanos":1783255318234925202,"mode":420,"is_dir":false},"packages/auth/dist/recovery-codes.js.map":{"size":949,"mtime_nanos":1783255318234865402,"mode":420,"is_dir":false},"packages/auth/dist/index.d.ts":{"size":1570,"mtime_nanos":1783255318234480642,"mode":420,"is_dir":false},"packages/auth/dist/recovery-codes.d.ts":{"size":264,"mtime_nanos":1783255318234800762,"mode":420,"is_dir":false},"packages/auth/dist/username.js":{"size":2787,"mtime_nanos":1783255318235144382,"mode":420,"is_dir":false},"packages/auth/dist/tokens.js.map":{"size":760,"mtime_nanos":1783255318235017152,"mode":420,"is_dir":false},"packages/auth/dist/username.js.map":{"size":2294,"mtime_nanos":1783255318235160872,"mode":420,"is_dir":false},"packages/auth/dist/password.d.ts.map":{"size":266,"mtime_nanos":1783255318234717722,"mode":420,"is_dir":false},"packages/auth/dist/index.js.map":{"size":824,"mtime_nanos":1783255318234638252,"mode":420,"is_dir":false},"packages/auth/dist/session.js.map":{"size":493,"mtime_nanos":1783255318234944292,"mode":420,"is_dir":false},"packages/auth/dist/index.d.ts.map":{"size":1443,"mtime_nanos":1783255318234518132,"mode":420,"is_dir":false},"packages/auth/dist/session.d.ts":{"size":334,"mtime_nanos":1783255318234883722,"mode":420,"is_dir":false},"packages/auth/dist/password.js":{"size":482,"mtime_nanos":1783255318234755462,"mode":420,"is_dir":false},"packages/auth/dist/recovery-codes.js":{"size":1089,"mtime_nanos":1783255318234843272,"mode":420,"is_dir":false},"packages/auth/dist/recovery-codes.d.ts.map":{"size":306,"mtime_nanos":1783255318234822282,"mode":420,"is_dir":false},"packages/auth/dist/username.d.ts.map":{"size":430,"mtime_nanos":1783255318235123102,"mode":420,"is_dir":false},"packages/auth/dist/password.js.map":{"size":404,"mtime_nanos":1783255318234775572,"mode":420,"is_dir":false},"packages/auth/dist/tokens.d.ts.map":{"size":281,"mtime_nanos":1783255318234984402,"mode":420,"is_dir":false},"packages/auth/dist/username.d.ts":{"size":442,"mtime_nanos":1783255318235106382,"mode":420,"is_dir":false},"packages/auth/dist/index.js":{"size":4135,"mtime_nanos":1783255318234572542,"mode":420,"is_dir":false},"packages/auth/dist/totp.d.ts.map":{"size":303,"mtime_nanos":1783255318235050102,"mode":420,"is_dir":false},"packages/auth/dist/tokens.js":{"size":864,"mtime_nanos":1783255318235000782,"mode":420,"is_dir":false},"packages/auth/dist/session.d.ts.map":{"size":300,"mtime_nanos":1783255318234901542,"mode":420,"is_dir":false},"packages/auth/dist/totp.js.map":{"size":569,"mtime_nanos":1783255318235085572,"mode":420,"is_dir":false},"packages/auth/dist/tokens.d.ts":{"size":244,"mtime_nanos":1783255318234964842,"mode":420,"is_dir":false}},"order":["packages/auth/.turbo/turbo-build.log","packages/auth/dist/index.d.ts","packages/auth/dist/index.d.ts.map","packages/auth/dist/index.js","packages/auth/dist/index.js.map","packages/auth/dist/password.d.ts","packages/auth/dist/password.d.ts.map","packages/auth/dist/password.js","packages/auth/dist/password.js.map","packages/auth/dist/recovery-codes.d.ts","packages/auth/dist/recovery-codes.d.ts.map","packages/auth/dist/recovery-codes.js","packages/auth/dist/recovery-codes.js.map","packages/auth/dist/session.d.ts","packages/auth/dist/session.d.ts.map","packages/auth/dist/session.js","packages/auth/dist/session.js.map","packages/auth/dist/tokens.d.ts","packages/auth/dist/tokens.d.ts.map","packages/auth/dist/tokens.js","packages/auth/dist/tokens.js.map","packages/auth/dist/totp.d.ts","packages/auth/dist/totp.d.ts.map","packages/auth/dist/totp.js","packages/auth/dist/totp.js.map","packages/auth/dist/username.d.ts","packages/auth/dist/username.d.ts.map","packages/auth/dist/username.js","packages/auth/dist/username.js.map"]}
\ No newline at end of file
diff --git a/.turbo/cache/1b4ddb8b5e9b564a-manifest.json b/.turbo/cache/1b4ddb8b5e9b564a-manifest.json
new file mode 100644
index 0000000..28ba932
--- /dev/null
+++ b/.turbo/cache/1b4ddb8b5e9b564a-manifest.json
@@ -0,0 +1 @@
+{"files":{"packages/database/.turbo/turbo-build.log":{"size":549,"mtime_nanos":1783255321226890055,"mode":420,"is_dir":false},"packages/database/dist":{"size":0,"mtime_nanos":0,"mode":0,"is_dir":true},"packages/database/dist/index.d.ts":{"size":991,"mtime_nanos":1783255321208338929,"mode":420,"is_dir":false},"packages/database/dist/index.d.ts.map":{"size":733,"mtime_nanos":1783255321207890090,"mode":420,"is_dir":false},"packages/database/dist/index.js":{"size":962,"mtime_nanos":1783255321192311503,"mode":420,"is_dir":false},"packages/database/dist/index.js.map":{"size":617,"mtime_nanos":1783255321191890119,"mode":420,"is_dir":false}},"order":["packages/database/.turbo/turbo-build.log","packages/database/dist","packages/database/dist/index.d.ts","packages/database/dist/index.d.ts.map","packages/database/dist/index.js","packages/database/dist/index.js.map"]}
\ No newline at end of file
diff --git a/.turbo/cache/1b4ddb8b5e9b564a-meta.json b/.turbo/cache/1b4ddb8b5e9b564a-meta.json
new file mode 100644
index 0000000..c6cb271
--- /dev/null
+++ b/.turbo/cache/1b4ddb8b5e9b564a-meta.json
@@ -0,0 +1 @@
+{"hash":"1b4ddb8b5e9b564a","duration":2992,"sha":"2126e7bebf9ff0796ac77f8548cba399f45e759a","dirty_hash":null}
\ No newline at end of file
diff --git a/.turbo/cache/1b4ddb8b5e9b564a.tar.zst b/.turbo/cache/1b4ddb8b5e9b564a.tar.zst
new file mode 100644
index 0000000..4e9fa84
Binary files /dev/null and b/.turbo/cache/1b4ddb8b5e9b564a.tar.zst differ
diff --git a/.turbo/cache/8de6070230e6cb7f-manifest.json b/.turbo/cache/8de6070230e6cb7f-manifest.json
new file mode 100644
index 0000000..7a0c3ba
--- /dev/null
+++ b/.turbo/cache/8de6070230e6cb7f-manifest.json
@@ -0,0 +1 @@
+{"files":{"packages/dns/dist/slug.js.map":{"size":1132,"mtime_nanos":1783255322378871763,"mode":420,"is_dir":false},"packages/dns/dist/sync.d.ts.map":{"size":782,"mtime_nanos":1783255322414887899,"mode":420,"is_dir":false},"packages/dns/dist/providers/types.d.ts.map":{"size":676,"mtime_nanos":1783255322384887953,"mode":420,"is_dir":false},"packages/dns/dist/providers/local.js":{"size":432,"mtime_nanos":1783255322388768830,"mode":420,"is_dir":false},"packages/dns/dist/providers/index.js.map":{"size":513,"mtime_nanos":1783255322403887919,"mode":420,"is_dir":false},"packages/dns/.turbo/turbo-build.log":{"size":96,"mtime_nanos":1783255322435887861,"mode":420,"is_dir":false},"packages/dns/dist/index.js.map":{"size":423,"mtime_nanos":1783255322416887895,"mode":420,"is_dir":false},"packages/dns/dist/providers/types.d.ts":{"size":563,"mtime_nanos":1783255322385701971,"mode":420,"is_dir":false},"packages/dns/dist":{"size":0,"mtime_nanos":0,"mode":0,"is_dir":true},"packages/dns/dist/slug.d.ts":{"size":221,"mtime_nanos":1783255322381887959,"mode":420,"is_dir":false},"packages/dns/dist/providers/local.d.ts.map":{"size":379,"mtime_nanos":1783255322389887944,"mode":420,"is_dir":false},"packages/dns/dist/slug.test.d.ts.map":{"size":112,"mtime_nanos":1783255322418786243,"mode":420,"is_dir":false},"packages/dns/dist/index.d.ts":{"size":419,"mtime_nanos":1783255322417734733,"mode":420,"is_dir":false},"packages/dns/dist/providers/index.d.ts":{"size":318,"mtime_nanos":1783255322404887917,"mode":420,"is_dir":false},"packages/dns/dist/providers/types.js.map":{"size":319,"mtime_nanos":1783255322382887957,"mode":420,"is_dir":false},"packages/dns/dist/providers/local.js.map":{"size":287,"mtime_nanos":1783255322388768830,"mode":420,"is_dir":false},"packages/dns/dist/providers/rfc2136.js.map":{"size":3122,"mtime_nanos":1783255322398887928,"mode":420,"is_dir":false},"packages/dns/dist/slug.test.js.map":{"size":763,"mtime_nanos":1783255322418743643,"mode":420,"is_dir":false},"packages/dns/dist/providers/local.d.ts":{"size":329,"mtime_nanos":1783255322389887944,"mode":420,"is_dir":false},"packages/dns/dist/providers/rfc2136.d.ts":{"size":363,"mtime_nanos":1783255322399887926,"mode":420,"is_dir":false},"packages/dns/dist/sync.js.map":{"size":5357,"mtime_nanos":1783255322411887905,"mode":420,"is_dir":false},"packages/dns/dist/providers/rfc2136.d.ts.map":{"size":407,"mtime_nanos":1783255322399887926,"mode":420,"is_dir":false},"packages/dns/dist/slug.js":{"size":1086,"mtime_nanos":1783255322378986443,"mode":420,"is_dir":false},"packages/dns/dist/providers/index.js":{"size":928,"mtime_nanos":1783255322404521026,"mode":420,"is_dir":false},"packages/dns/dist/index.js":{"size":2177,"mtime_nanos":1783255322417387574,"mode":420,"is_dir":false},"packages/dns/dist/index.d.ts.map":{"size":392,"mtime_nanos":1783255322417734733,"mode":420,"is_dir":false},"packages/dns/dist/sync.d.ts":{"size":774,"mtime_nanos":1783255322415276064,"mode":420,"is_dir":false},"packages/dns/dist/providers":{"size":0,"mtime_nanos":0,"mode":0,"is_dir":true},"packages/dns/dist/providers/index.d.ts.map":{"size":336,"mtime_nanos":1783255322404887917,"mode":420,"is_dir":false},"packages/dns/dist/slug.d.ts.map":{"size":260,"mtime_nanos":1783255322381887959,"mode":420,"is_dir":false},"packages/dns/dist/slug.test.d.ts":{"size":50,"mtime_nanos":1783255322418786243,"mode":420,"is_dir":false},"packages/dns/dist/slug.test.js":{"size":921,"mtime_nanos":1783255322418786243,"mode":420,"is_dir":false},"packages/dns/dist/providers/rfc2136.js":{"size":3012,"mtime_nanos":1783255322399634098,"mode":420,"is_dir":false},"packages/dns/dist/sync.js":{"size":5955,"mtime_nanos":1783255322412413185,"mode":420,"is_dir":false},"packages/dns/dist/providers/types.js":{"size":333,"mtime_nanos":1783255322382887957,"mode":420,"is_dir":false}},"order":["packages/dns/.turbo/turbo-build.log","packages/dns/dist","packages/dns/dist/index.d.ts","packages/dns/dist/index.d.ts.map","packages/dns/dist/index.js","packages/dns/dist/index.js.map","packages/dns/dist/providers","packages/dns/dist/providers/index.d.ts","packages/dns/dist/providers/index.d.ts.map","packages/dns/dist/providers/index.js","packages/dns/dist/providers/index.js.map","packages/dns/dist/providers/local.d.ts","packages/dns/dist/providers/local.d.ts.map","packages/dns/dist/providers/local.js","packages/dns/dist/providers/local.js.map","packages/dns/dist/providers/rfc2136.d.ts","packages/dns/dist/providers/rfc2136.d.ts.map","packages/dns/dist/providers/rfc2136.js","packages/dns/dist/providers/rfc2136.js.map","packages/dns/dist/providers/types.d.ts","packages/dns/dist/providers/types.d.ts.map","packages/dns/dist/providers/types.js","packages/dns/dist/providers/types.js.map","packages/dns/dist/slug.d.ts","packages/dns/dist/slug.d.ts.map","packages/dns/dist/slug.js","packages/dns/dist/slug.js.map","packages/dns/dist/slug.test.d.ts","packages/dns/dist/slug.test.d.ts.map","packages/dns/dist/slug.test.js","packages/dns/dist/slug.test.js.map","packages/dns/dist/sync.d.ts","packages/dns/dist/sync.d.ts.map","packages/dns/dist/sync.js","packages/dns/dist/sync.js.map"]}
\ No newline at end of file
diff --git a/.turbo/cache/8de6070230e6cb7f-meta.json b/.turbo/cache/8de6070230e6cb7f-meta.json
new file mode 100644
index 0000000..ca96182
--- /dev/null
+++ b/.turbo/cache/8de6070230e6cb7f-meta.json
@@ -0,0 +1 @@
+{"hash":"8de6070230e6cb7f","duration":1207,"sha":"2126e7bebf9ff0796ac77f8548cba399f45e759a","dirty_hash":null}
\ No newline at end of file
diff --git a/.turbo/cache/8de6070230e6cb7f.tar.zst b/.turbo/cache/8de6070230e6cb7f.tar.zst
new file mode 100644
index 0000000..7d23115
Binary files /dev/null and b/.turbo/cache/8de6070230e6cb7f.tar.zst differ
diff --git a/README.md b/README.md
index adb0365..a713237 100644
--- a/README.md
+++ b/README.md
@@ -137,7 +137,7 @@ pnpm db:migrate
 pnpm dev
 
 # Admin anlegen (keine Default-Zugangsdaten)
-pnpm bootstrap:admin -- --email admin@localhost --password 'min-12-chars-here'
+pnpm bootstrap:admin -- --email admin@example.com --password 'min-12-chars-here'
 ```
 
 | Flow | URL |
diff --git a/packages/contracts/src/auth.ts b/packages/contracts/src/auth.ts
index 6981846..77bbe45 100644
--- a/packages/contracts/src/auth.ts
+++ b/packages/contracts/src/auth.ts
@@ -1,6 +1,6 @@
 import { z } from 'zod';
 
-const emailSchema = z.string().email().max(320);
+export const emailSchema = z.string().email().max(320);
 const passwordSchema = z.string().min(12).max(128);
 
 export const registerRequestSchema = z.object({
diff --git a/packages/contracts/src/index.ts b/packages/contracts/src/index.ts
index 24800fb..90bcacf 100644
--- a/packages/contracts/src/index.ts
+++ b/packages/contracts/src/index.ts
@@ -23,6 +23,7 @@ export {
 } from './pagination';
 
 export {
+  emailSchema,
   registerRequestSchema,
   loginRequestSchema,
   verifyEmailRequestSchema,
diff --git a/packages/database/package.json b/packages/database/package.json
index 34ca48c..dc95ce0 100644
--- a/packages/database/package.json
+++ b/packages/database/package.json
@@ -18,6 +18,7 @@
   },
   "devDependencies": {
     "@hexahost/auth": "workspace:*",
+    "@hexahost/contracts": "workspace:*",
     "@hexahost/typescript-config": "workspace:*",
     "@types/node": "^22.10.2",
     "prisma": "^6.3.1",
diff --git a/packages/database/src/cli/bootstrap-admin.ts b/packages/database/src/cli/bootstrap-admin.ts
index 0ced4b7..cb1ab32 100644
--- a/packages/database/src/cli/bootstrap-admin.ts
+++ b/packages/database/src/cli/bootstrap-admin.ts
@@ -1,4 +1,5 @@
 import { PrismaClient } from '@prisma/client';
+import { emailSchema } from '@hexahost/contracts';
 
 import {
   generateUsernameFromEmail,
@@ -6,6 +7,8 @@ import {
   validateUsername,
 } from '@hexahost/auth';
 
+const emailSchema = z.string().email().max(320);
+
 const PLATFORM_ROLES = [
   'USER',
   'SUPPORT',
@@ -48,8 +51,17 @@ function parseArgs(argv: string[]): CliArgs {
     process.exit(1);
   }
 
+  const email = args['email'].trim().toLowerCase();
+  const emailResult = emailSchema.safeParse(email);
+  if (!emailResult.success) {
+    console.error(
+      `Invalid email "${email}". Use a valid address (e.g. admin@example.com).`,
+    );
+    process.exit(1);
+  }
+
   return {
-    email: args['email'].trim().toLowerCase(),
+    email,
     password: args['password'],
     username: args['username'],
     displayName: args['display-name'],
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 7701ade..b5b0776 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -318,6 +318,9 @@ importers:
       '@hexahost/auth':
         specifier: workspace:*
         version: link:../auth
+      '@hexahost/contracts':
+        specifier: workspace:*
+        version: link:../contracts
       '@hexahost/typescript-config':
         specifier: workspace:*
         version: link:../typescript-config