diff --git a/DEPLOYMENT.md b/DEPLOYMENT.md
index cab4ae8..774a560 100644
--- a/DEPLOYMENT.md
+++ b/DEPLOYMENT.md
@@ -1024,6 +1024,25 @@ server {
         proxy_send_timeout 300s;
     }
 
+    # Admin-Live-Log (WebSocket) — Auth wie unten, aber mit WS-Upgrade wie /ws/.
+    # OHNE diesen Block bleibt der Log-Tab im Admin-Panel leer ("Verbindungsfehler"),
+    # weil /api/admin/log sonst in location / ohne Upgrade-Header landet.
+    location = /api/admin/log {
+        auth_request /authelia-check;
+        auth_request_set $user $upstream_http_remote_user;
+        error_page 401 =302 https://auth.jamulix.de/?rd=$scheme://$http_host$request_uri;
+
+        proxy_pass http://127.0.0.1:8003;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For "";
+        proxy_set_header Remote-User $user;
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+    }
+
     # Alle anderen Routen — Authelia 2FA-Schutz
     location / {
         auth_request /authelia-check;