diff --git a/app.py b/app.py
index ab17b93..892c3db 100644
--- a/app.py
+++ b/app.py
@@ -927,37 +927,54 @@ def admin_users_edit_route(user_id):
     if not u:
         abort(404)
     error = None
+    ok_msg = None
     if request.method == "POST":
+        email = request.form.get("email", "").strip().lower()
         vorname = request.form.get("vorname", "").strip()
         nachname = request.form.get("nachname", "").strip()
         telefon = request.form.get("telefon", "").strip()
         abteilung = request.form.get("abteilung", "").strip()
         adresse = request.form.get("adresse", "").strip()
-        db.update_user_profile(tenant_id, user_id, vorname or None, nachname or None,
-                                telefon or None, abteilung or None, adresse or None)
-        db.log_audit(tenant_id, session["user_id"], "user_profile_updated", "user", str(user_id),
-                     None, _client_ip())
-        u = dict(u)
-        u.update({"vorname": vorname, "nachname": nachname, "telefon": telefon,
-                  "abteilung": abteilung, "adresse": adresse})
-        error = "Gespeichert."
-    err_html = ("<p class='sz' style='color:var(--ok)'>%s</p>" % html.escape(error)) if error else ""
+        if not email or "@" not in email:
+            error = "Bitte eine gueltige E-Mail-Adresse angeben."
+        elif db.email_exists_excluding(email, user_id):
+            error = "Diese E-Mail-Adresse wird bereits von einem anderen Benutzer verwendet."
+        else:
+            old_email = u["email"]
+            if email != old_email:
+                db.update_user_email(tenant_id, user_id, email)
+                db.log_audit(tenant_id, session["user_id"], "user_email_changed", "user", str(user_id),
+                             {"alt": old_email, "neu": email}, _client_ip())
+                if user_id == session["user_id"]:
+                    session["email"] = email
+            db.update_user_profile(tenant_id, user_id, vorname or None, nachname or None,
+                                    telefon or None, abteilung or None, adresse or None)
+            db.log_audit(tenant_id, session["user_id"], "user_profile_updated", "user", str(user_id),
+                         None, _client_ip())
+            u = dict(u)
+            u.update({"email": email, "vorname": vorname, "nachname": nachname, "telefon": telefon,
+                      "abteilung": abteilung, "adresse": adresse})
+            ok_msg = "Gespeichert."
+    err_html = "<p class='err'>%s</p>" % html.escape(error) if error else ""
+    ok_html = ("<p class='sz' style='color:var(--ok)'>%s</p>" % html.escape(ok_msg)) if ok_msg else ""
     body = """<h1 class="page-title">Benutzerdetails</h1>
-<div class="sz" style="margin-bottom:14px">%s</div>
-<div class="panel">%s<form method="post">
+<div class="panel">%s%s<form method="post">
+<div class="formrow"><label>E-Mail (Login)</label><input type="email" name="email" value="%s" required></div>
+<div class="hint">Wird sofort als Login-Adresse wirksam. Aenderungen werden im Audit-Log erfasst.</div>
+<h2 class="section-title" style="margin-top:14px">Details (optional)</h2>
 <div class="grid-2">
-<div class="formrow"><label>Vorname</label><input name="vorname" value="%s"></div>
-<div class="formrow"><label>Nachname</label><input name="nachname" value="%s"></div>
+<div class="formrow"><label>Vorname</label><input type="text" name="vorname" value="%s"></div>
+<div class="formrow"><label>Nachname</label><input type="text" name="nachname" value="%s"></div>
 </div>
 <div class="grid-2">
-<div class="formrow"><label>Telefon</label><input name="telefon" value="%s"></div>
-<div class="formrow"><label>Abteilung</label><input name="abteilung" value="%s"></div>
+<div class="formrow"><label>Telefon</label><input type="text" name="telefon" value="%s"></div>
+<div class="formrow"><label>Abteilung</label><input type="text" name="abteilung" value="%s"></div>
 </div>
-<div class="formrow"><label>Adresse</label><input name="adresse" value="%s"></div>
+<div class="formrow"><label>Adresse</label><input type="text" name="adresse" value="%s"></div>
 <button class="btn" type="submit">Speichern</button>
 </form></div>
 <a class="btn ghost" href="/admin/users">Zurueck zur Benutzerverwaltung</a>""" % (
-        html.escape(u["email"]), err_html,
+        err_html, ok_html, html.escape(u["email"]),
         html.escape(u["vorname"] or ""), html.escape(u["nachname"] or ""),
         html.escape(u["telefon"] or ""), html.escape(u["abteilung"] or ""),
         html.escape(u["adresse"] or ""),