diff --git a/deploy_script.sh b/deploy_script.sh
index f66bcc4..daff84d 100644
--- a/deploy_script.sh
+++ b/deploy_script.sh
@@ -343,30 +343,6 @@ decrypt_envs() {
         if [[ -f "${svc_dir}/.env.age" ]]; then
             age --decrypt -i "${AGE_PRIVATE_KEY}" -o "${svc_dir}/.env" "${svc_dir}/.env.age"
             sed -i 's/\r$//' "${svc_dir}/.env"
-
-            # Ensure BETTER_AUTH_SECRET is set for Paperclip
-            if [[ "${svc_name}" == "paperclip" ]]; then
-                if ! grep -q "BETTER_AUTH_SECRET" "${svc_dir}/.env"; then
-                    log "Generating missing BETTER_AUTH_SECRET in .env..."
-                    echo "BETTER_AUTH_SECRET=\"$(openssl rand -hex 32)\"" >> "${svc_dir}/.env"
-                fi
-
-                # Auto-configure default LLM (OPENAI_* Overrides) aus shared.env lesen
-                if ! grep -q "OPENAI_API_KEY=" "${svc_dir}/.env" && ! grep -q "ANTHROPIC_API_KEY=" "${svc_dir}/.env"; then
-                    if [[ -f "${shared_env}" ]] && grep -q "OPENROUTER_API_KEY=" "${shared_env}"; then
-                        log "Auto-configuring OpenRouter as default LLM..."
-                        echo "" >> "${svc_dir}/.env"
-                        echo "OPENAI_BASE_URL=https://openrouter.ai/api/v1" >> "${svc_dir}/.env"
-                        grep "OPENROUTER_API_KEY=" "${shared_env}" | sed 's/OPENROUTER_API_KEY=/OPENAI_API_KEY=/' >> "${svc_dir}/.env"
-                    elif [[ -f "${shared_env}" ]] && grep -q "MISTRAL_API_KEY=" "${shared_env}"; then
-                        log "Auto-configuring Mistral as default LLM..."
-                        echo "" >> "${svc_dir}/.env"
-                        echo "OPENAI_BASE_URL=https://api.mistral.ai/v1" >> "${svc_dir}/.env"
-                        grep "MISTRAL_API_KEY=" "${shared_env}" | sed 's/MISTRAL_API_KEY=/OPENAI_API_KEY=/' >> "${svc_dir}/.env"
-                    fi
-                fi
-            fi
-
             chmod 600 "${svc_dir}/.env"
         fi
     done
@@ -436,10 +412,20 @@ start_remaining() {
 }
 
 ###############################################################################
-# 9. Service-Init-Skripte ausführen
-#    Jeder Service kann eine "service.init"-Datei haben, die nach dem Start
-#    aufgerufen wird und den Service vollständig einrichtet.
+# 9. Service-Init-Skripte ausführen (Pre & Post)
 ###############################################################################
+run_service_pre_starts() {
+    log "Running service.pre_start scripts..."
+    for svc_name in "${ACTIVE_SERVICES[@]}"; do
+        local pre_script="${SERVICES_DIR}/${svc_name}/service.pre_start"
+        if [[ -f "${pre_script}" ]]; then
+            log "--- Running pre_start for: ${svc_name} ---"
+            chmod +x "${pre_script}"
+            bash "${pre_script}" || warn "service.pre_start for '${svc_name}' exited with errors (non-fatal)."
+        fi
+    done
+}
+
 run_service_inits() {
     log "Running service.init scripts..."
     for svc_name in "${ACTIVE_SERVICES[@]}"; do
@@ -479,6 +465,7 @@ main() {
     enable_maintenance_mode
     stop_all_services
     decrypt_envs
+    run_service_pre_starts
     create_volumes
     pull_images
     start_infra
diff --git a/services/paperclip/service.pre_start b/services/paperclip/service.pre_start
new file mode 100644
index 0000000..00147f2
--- /dev/null
+++ b/services/paperclip/service.pre_start
@@ -0,0 +1,33 @@
+#!/bin/bash
+set -euo pipefail
+
+SVC_DIR="${SERVICES_DIR}/paperclip"
+SHARED_ENV="${SERVICES_DIR}/shared.env"
+ENV_FILE="${SVC_DIR}/.env"
+
+echo "[PaperClip Pre-Start] Checking configuration..."
+
+if [[ -f "${ENV_FILE}" ]]; then
+    # Ensure BETTER_AUTH_SECRET is set for Paperclip
+    if ! grep -q "BETTER_AUTH_SECRET" "${ENV_FILE}"; then
+        echo "[PaperClip Pre-Start] Generating missing BETTER_AUTH_SECRET in .env..."
+        echo "BETTER_AUTH_SECRET=\"$(openssl rand -hex 32)\"" >> "${ENV_FILE}"
+    fi
+
+    # Auto-configure default LLM (OPENAI_* Overrides) aus shared.env lesen
+    if ! grep -q "OPENAI_API_KEY=" "${ENV_FILE}" && ! grep -q "ANTHROPIC_API_KEY=" "${ENV_FILE}"; then
+        if [[ -f "${SHARED_ENV}" ]] && grep -q "OPENROUTER_API_KEY=" "${SHARED_ENV}"; then
+            echo "[PaperClip Pre-Start] Auto-configuring OpenRouter as default LLM..."
+            echo "" >> "${ENV_FILE}"
+            echo "OPENAI_BASE_URL=https://openrouter.ai/api/v1" >> "${ENV_FILE}"
+            grep "OPENROUTER_API_KEY=" "${SHARED_ENV}" | sed 's/OPENROUTER_API_KEY=/OPENAI_API_KEY=/' >> "${ENV_FILE}"
+        elif [[ -f "${SHARED_ENV}" ]] && grep -q "MISTRAL_API_KEY=" "${SHARED_ENV}"; then
+            echo "[PaperClip Pre-Start] Auto-configuring Mistral as default LLM..."
+            echo "" >> "${ENV_FILE}"
+            echo "OPENAI_BASE_URL=https://api.mistral.ai/v1" >> "${ENV_FILE}"
+            grep "MISTRAL_API_KEY=" "${SHARED_ENV}" | sed 's/MISTRAL_API_KEY=/OPENAI_API_KEY=/' >> "${ENV_FILE}"
+        fi
+    fi
+else
+    echo "[PaperClip Pre-Start] Warning: No .env found!"
+fi