diff --git a/DeskHub-Webseite/database/migrate.php b/DeskHub-Webseite/database/migrate.php
index c0280bf4..93b9f734 100644
--- a/DeskHub-Webseite/database/migrate.php
+++ b/DeskHub-Webseite/database/migrate.php
@@ -2106,6 +2106,50 @@ function run_migrations(PDO $pdo, bool $verbose = false): array
         }
     }
 
+    // Migration 0075: Passkeys (WebAuthn) für die Anmeldung der Mitarbeiter.
+    if (!isset($done['php_0075_staff_passkeys'])) {
+        try {
+            $sqlite = $pdo->getAttribute(PDO::ATTR_DRIVER_NAME) === 'sqlite';
+            $ai = $sqlite ? 'INTEGER PRIMARY KEY AUTOINCREMENT' : 'INT AUTO_INCREMENT PRIMARY KEY';
+            $pdo->exec("CREATE TABLE IF NOT EXISTS staff_passkeys (
+                id            {$ai},
+                staff_id      INT NOT NULL,
+                credential_id VARCHAR(512) NOT NULL,
+                public_key    TEXT NOT NULL,
+                alg           INT NOT NULL DEFAULT -7,
+                sign_count    BIGINT NOT NULL DEFAULT 0,
+                name          VARCHAR(80) NOT NULL,
+                created_at    DATETIME NOT NULL,
+                last_used_at  DATETIME NULL
+            )" . ($sqlite ? '' : ' ENGINE=InnoDB DEFAULT CHARSET=utf8mb4'));
+            $pdo->exec($sqlite ? 'CREATE UNIQUE INDEX IF NOT EXISTS idx_staff_passkeys_cred ON staff_passkeys (credential_id)' : 'CREATE UNIQUE INDEX idx_staff_passkeys_cred ON staff_passkeys (credential_id(190))');
+            $pdo->exec('CREATE INDEX idx_staff_passkeys_staff ON staff_passkeys (staff_id)');
+            $pdo->prepare('INSERT INTO schema_migrations (migration) VALUES (?)')->execute(['php_0075_staff_passkeys']);
+            $result['applied']++;
+            if ($verbose) $result['log'][] = '  [OK]   php_0075_staff_passkeys';
+        } catch (Throwable $e) {
+            $result['errors'][] = 'php_0075_staff_passkeys: ' . $e->getMessage();
+            if ($verbose) $result['log'][] = '  [FAIL] php_0075_staff_passkeys - ' . $e->getMessage();
+        }
+    }
+
+    // Migration 0076: vordefinierte Rollen (Co-Administrator, Support-Manager, IT, Teamleitung, Support 1st/2nd Level, …). Vorhandene Rollen bleiben unberührt.
+    if (!isset($done['php_0076_default_roles'])) {
+        try {
+            require_once __DIR__ . '/../includes/permissions.php';
+            $cols = array_map(fn($r) => (string) ($r['name'] ?? $r['Field'] ?? ''), $pdo->query($pdo->getAttribute(PDO::ATTR_DRIVER_NAME) === 'sqlite' ? 'PRAGMA table_info(roles)' : 'SHOW COLUMNS FROM roles')->fetchAll());
+            if (in_array('is_active', $cols, true) && in_array('notes', $cols, true) && in_array('updated_at', $cols, true)) {
+                permission_seed_default_roles($pdo);
+                $pdo->prepare('INSERT INTO schema_migrations (migration) VALUES (?)')->execute(['php_0076_default_roles']);
+                $result['applied']++;
+                if ($verbose) $result['log'][] = '  [OK]   php_0076_default_roles';
+            }
+        } catch (Throwable $e) {
+            $result['errors'][] = 'php_0076_default_roles: ' . $e->getMessage();
+            if ($verbose) $result['log'][] = '  [FAIL] php_0076_default_roles - ' . $e->getMessage();
+        }
+    }
+
     return $result;
 }