diff --git a/app.py b/app.py
index 8b60298..a5d3493 100644
--- a/app.py
+++ b/app.py
@@ -235,6 +235,18 @@ def _shell(active_path, title, body_html, extra_head=""):
 @app.route("/setup/new", methods=["GET", "POST"])
 def setup_new():
     error = None
+    # Vorbelegung: bei GET die Standardwerte, bei einem fehlgeschlagenen POST
+    # die vom Nutzer eingegebenen Werte (ausser Passwoerter -- die bleiben aus
+    # Sicherheitsgruenden leer und muessen erneut eingegeben werden).
+    firma = ""
+    email = ""
+    dsb_name = ""
+    dsb_email = ""
+    retention_tickets = "1095"
+    retention_audit = "1825"
+    sla_antwort = "480"
+    sla_loesung = "2880"
+
     if request.method == "POST":
         firma = request.form.get("firma", "").strip()
         email = request.form.get("email", "").strip().lower()
@@ -288,9 +300,9 @@ def setup_new():
 <div class="sz" style="margin-bottom:14px">Jede Organisation erhaelt einen eigenen, getrennten Mandanten. Diese Angaben lassen sich unter Einstellungen jederzeit anpassen.</div>
 %s
 <h2 class="section-title" style="margin-top:0">Firmenprofil</h2>
-<div class="formrow"><label>Firmenname</label><input name="firma" required></div>
+<div class="formrow"><label>Firmenname</label><input name="firma" value="%s" required></div>
 <h2 class="section-title">Administrator-Konto</h2>
-<div class="formrow"><label>E-Mail (Login)</label><input name="email" type="email" required></div>
+<div class="formrow"><label>E-Mail (Login)</label><input name="email" type="email" value="%s" required></div>
 <div class="grid-2">
 <div class="formrow"><label>Passwort</label><input name="password" type="password" required></div>
 <div class="formrow"><label>Passwort wiederholen</label><input name="password2" type="password" required></div>
@@ -298,22 +310,28 @@ def setup_new():
 <div class="hint">Mindestens 10 Zeichen.</div>
 <h2 class="section-title">SLA-Standardwerte</h2>
 <div class="grid-2">
-<div class="formrow"><label>Antwortzeit (Minuten)</label><input name="sla_antwort_minuten" type="number" value="480"></div>
-<div class="formrow"><label>Loesungszeit (Minuten)</label><input name="sla_loesung_minuten" type="number" value="2880"></div>
+<div class="formrow"><label>Antwortzeit (Minuten)</label><input name="sla_antwort_minuten" type="number" value="%s"></div>
+<div class="formrow"><label>Loesungszeit (Minuten)</label><input name="sla_loesung_minuten" type="number" value="%s"></div>
 </div>
 <h2 class="section-title">Datenschutz (DSGVO)</h2>
 <div class="grid-2">
-<div class="formrow"><label>Datenschutzbeauftragter/Kontakt</label><input name="dsb_name"></div>
-<div class="formrow"><label>Kontakt-E-Mail</label><input name="dsb_email" type="email"></div>
+<div class="formrow"><label>Datenschutzbeauftragter/Kontakt</label><input name="dsb_name" value="%s"></div>
+<div class="formrow"><label>Kontakt-E-Mail</label><input name="dsb_email" type="email" value="%s"></div>
 </div>
 <div class="grid-2">
-<div class="formrow"><label>Aufbewahrung Tickets (Tage)</label><input name="retention_tickets_days" type="number" value="1095"></div>
-<div class="formrow"><label>Aufbewahrung Audit-Log (Tage)</label><input name="retention_audit_days" type="number" value="1825"></div>
+<div class="formrow"><label>Aufbewahrung Tickets (Tage)</label><input name="retention_tickets_days" type="number" value="%s"></div>
+<div class="formrow"><label>Aufbewahrung Audit-Log (Tage)</label><input name="retention_audit_days" type="number" value="%s"></div>
 </div>
 <div class="hint">Diese Werte legen fest, wie lange Tickets bzw. Audit-Eintraege vorgehalten werden (DSGVO Speicherbegrenzung). Ein Hintergrund-Job bereinigt automatisch alle 24 Stunden.</div>
 <button class="btn" type="submit" style="margin-top:8px">Organisation anlegen</button>
 <div class="sz" style="margin-top:12px">Bereits registriert? <a href="/login">Anmelden</a></div>
-</form></div></body></html>""" % (_CSS_TAG, err_html)
+</form></div></body></html>""" % (
+        _CSS_TAG, err_html,
+        html.escape(firma), html.escape(email),
+        html.escape(sla_antwort), html.escape(sla_loesung),
+        html.escape(dsb_name), html.escape(dsb_email),
+        html.escape(retention_tickets), html.escape(retention_audit),
+    )
 
 
 # ── Login/Logout ────────────────────────────────────────────────────────────────