diff --git a/deploy/install.sh b/deploy/install.sh
index 689eacd..c71c86d 100755
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -68,6 +68,14 @@ rm -f /etc/nginx/sites-enabled/default
 nginx -t
 systemctl reload nginx
 
+echo "[+] CLI-Wrapper /usr/local/bin/voice-agent-admin"
+cat > /usr/local/bin/voice-agent-admin <<'WRAPPER'
+#!/usr/bin/env bash
+exec sudo -u deploy /var/www/voice-agent/lxc-frontend/.venv/bin/python \
+    /var/www/voice-agent/lxc-frontend/app/cli.py "$@"
+WRAPPER
+chmod 0755 /usr/local/bin/voice-agent-admin
+
 echo
 echo "Fertig. Health-Check:"
 echo "  curl -s http://localhost/health"
diff --git a/lxc-frontend/app/cli.py b/lxc-frontend/app/cli.py
index 74abdad..249578c 100644
--- a/lxc-frontend/app/cli.py
+++ b/lxc-frontend/app/cli.py
@@ -1,7 +1,11 @@
 """CLI-Tool für Notfall-User-Verwaltung.
 
-Aufruf am LXC:
-    sudo -u deploy /var/www/voice-agent/lxc-frontend/.venv/bin/python -m app.cli <befehl> [...]
+Aufruf am LXC (von überall, absoluter Pfad):
+    sudo -u deploy /var/www/voice-agent/lxc-frontend/.venv/bin/python \\
+        /var/www/voice-agent/lxc-frontend/app/cli.py <befehl> [...]
+
+Bequemer ist der Wrapper (vom install.sh angelegt):
+    sudo voice-agent-admin <befehl> [...]
 
 Befehle:
     list                              — alle User auflisten
@@ -14,13 +18,19 @@ Befehle:
 from __future__ import annotations
 
 import sys
+from pathlib import Path
 
-from sqlmodel import Session, select
+# Damit Skript auch ohne `cd` und ohne `-m` läuft: lxc-frontend/ auf sys.path.
+_LXC_FRONTEND = Path(__file__).resolve().parent.parent
+if str(_LXC_FRONTEND) not in sys.path:
+    sys.path.insert(0, str(_LXC_FRONTEND))
 
-from app.core.auth import hash_password, verify_password
-from app.core.db import engine, init_db
-from app.core.migrate import run_migrations
-from app.models.user import User
+from sqlmodel import Session, select  # noqa: E402
+
+from app.core.auth import hash_password, verify_password  # noqa: E402
+from app.core.db import engine, init_db  # noqa: E402
+from app.core.migrate import run_migrations  # noqa: E402
+from app.models.user import User  # noqa: E402
 
 
 def _setup() -> None: