diff --git a/backend/nitro.config.ts b/backend/nitro.config.ts
index 32e3d52..fdb7f13 100644
--- a/backend/nitro.config.ts
+++ b/backend/nitro.config.ts
@@ -10,6 +10,10 @@ export default defineNitroConfig({
   // Default-publicAssets greift nicht zuverlässig wenn srcDir auf "server" zeigt.
   publicAssets: [{ baseURL: "/", dir: "../public", maxAge: 60 * 60 }],
 
+  // Server-Assets: zur Build-Time eingebundelte Files (mobileconfig-Template etc.).
+  // Lesbar via useStorage('assets:server').getItem('mdm/<file>').
+  serverAssets: [{ baseName: "mdm", dir: "../ops/mdm" }],
+
   // Supabase als external dep — nicht bundlen
   externals: {
     inline: [/^(?!@supabase\/supabase-js)/],
diff --git a/backend/server/api/magic/profile.mobileconfig.get.ts b/backend/server/api/magic/profile.mobileconfig.get.ts
index b5462c3..b790def 100644
--- a/backend/server/api/magic/profile.mobileconfig.get.ts
+++ b/backend/server/api/magic/profile.mobileconfig.get.ts
@@ -1,13 +1,12 @@
 import { randomUUID } from "crypto";
-import { readFile } from "fs/promises";
-import { resolve } from "path";
 import { findMagicDeviceByToken } from "../../db/devices";
 
 /**
  * GET /api/magic/profile.mobileconfig?token=<dnsToken>
  *
  * Generiert personalisiertes DNS-Configuration-Profile für macOS.
- * Template: ops/mdm/rebreak-mac-dns-filter.mobileconfig
+ * Template: ops/mdm/rebreak-mac-dns-filter.mobileconfig (via Nitro serverAssets
+ * unter baseName "mdm" eingebundelt — siehe nitro.config.ts).
  *
  * Ersetzt:
  * - ServerURL: /dns-query → /dns-query/{token}
@@ -36,16 +35,16 @@ export default defineEventHandler(async (event) => {
     });
   }
 
-  // Template lesen
-  const templatePath = resolve(
-    process.cwd(),
-    "ops/mdm/rebreak-mac-dns-filter.mobileconfig",
-  );
-  let template: string;
-  try {
-    template = await readFile(templatePath, "utf-8");
-  } catch (err: any) {
-    console.error("[Magic] Failed to read profile template:", err);
+  // Template via Nitro serverAssets lesen (build-time eingebundelt → cwd-unabhängig).
+  const storage = useStorage("assets:server");
+  const template = (await storage.getItem(
+    "mdm/rebreak-mac-dns-filter.mobileconfig",
+  )) as string | null;
+
+  if (!template) {
+    console.error(
+      "[Magic] Profile template missing in serverAssets (mdm/rebreak-mac-dns-filter.mobileconfig)",
+    );
     throw createError({
       statusCode: 500,
       message: "Profile template not found",