diff --git a/backend/api/middleware.go b/backend/api/middleware.go
index 991a406..1445267 100644
--- a/backend/api/middleware.go
+++ b/backend/api/middleware.go
@@ -129,10 +129,13 @@ func hasAPIKeyPermission(key *db.APIKey, r *http.Request) bool {
 
 	switch perm {
 	case "agent":
-		// Nur Agent-Endpunkte: Registrierung, WS-Connect, Heartbeat
+		// Agent-Endpunkte: Registrierung, WS-Connect, Heartbeat, OTA-Update
 		return path == "/api/v1/agent/ws" ||
 			path == "/api/v1/agent/heartbeat" ||
-			path == "/api/v1/agent/register"
+			path == "/api/v1/agent/register" ||
+			path == "/api/v1/firmware" ||
+			path == "/api/v1/firmware/download" ||
+			strings.HasPrefix(path, "/api/v1/agents/")
 
 	case "read":
 		// Nur GET-Requests, keine destruktiven Aktionen