diff --git a/AGENTS.md b/AGENTS.md
index 3c6e6de..1a8bf19 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2006,6 +2006,33 @@ Capacitor's `server.url` pointed at HA was considered and **rejected**: it would
 current as the panel, but the shell then cannot boot without reaching HA, gutting the deliberately
 built offline queue (`api/warteschlange.ts`).
 
+**`install.ps1` couldn't authenticate to the Samba share, and gave a misleading error (found and
+fixed 2026-08-24, during the owner's first real deployment attempt).** The owner's Samba add-on was
+running and reachable — confirmed via its own log (`smbd`/`nmbd` started cleanly) and via
+`Test-Path`/`net use` from an interactive PowerShell session, which worked. Yet `install.ps1` kept
+reporting "Ziel nicht erreichbar" for the exact same path. Root cause: `Test-Path` on a UNC path
+**never prompts for credentials** — without an already-authenticated SMB session to that server, a
+password-protected share just returns `false`, with no error and no password prompt. The script had
+no credential handling at all; it only ever worked by accident, piggybacking on a session the user
+happened to have already established by hand (Explorer, or a manual `net use`). Once that session
+dropped — confirmed happening organically here when the Samba add-on itself restarted mid-session —
+the next run failed again with the same unhelpful message, even though path and password were both
+correct. Two side findings along the way, also worth remembering: (1) `Test-Path` against a UNC path
+can fail silently for reasons other than credentials, e.g. process elevation — a `net use` session
+established in a non-elevated shell is invisible to a process launched via "Run as administrator",
+because they're different logon contexts; `Installieren.cmd` needs no elevation and should always be
+run plainly. (2) Add-ons on Home Assistant OS often bind to their **own IP**, separate from HA
+Core's — the Samba add-on here answered on a different address than the one shown on
+Settings → System → Network, confirmed via the add-on's own broadcast log line and by successfully
+loading the HA frontend on that same IP.
+
+Fixed at the point of failure: if the target path isn't reachable, `install.ps1` now prompts for a
+username (defaulting to `homeassistant`, the Samba add-on's account) and password, clears any stale
+connection to the same path first (`net use $Ziel /delete`), and authenticates
+(`net use $Ziel /user:... ...`) before retrying `Test-Path`. Only a genuine auth/path failure after
+that throws. No more manual `net use` pre-step required. Verified the script still parses
+(`PSParser]::Tokenize`) after the edit; end-to-end verification pending the owner's next real run.
+
 ### G) Fresh-install audit + installer hardening (2026-08-23, before the first real deployment)
 
 > **Historical from here on.** This describes the pyscript-era package, which section H replaced
diff --git a/homeassistant/installationspaket/install.ps1 b/homeassistant/installationspaket/install.ps1
index 7478484..79fe333 100644
--- a/homeassistant/installationspaket/install.ps1
+++ b/homeassistant/installationspaket/install.ps1
@@ -159,7 +159,35 @@ if (-not $Ziel) {
 }
 
 if (-not (Test-Path $Ziel)) {
-    throw "Ziel nicht erreichbar: $Ziel - Samba-Share verbunden? Pfad korrekt?"
+    # Test-Path fragt nie nach einer Anmeldung: ohne eine bereits bestehende
+    # SMB-Sitzung zu diesem Server liefert es bei einem passwortgeschützten
+    # Share einfach "false" - ganz ohne Fehlermeldung oder Passwortabfrage.
+    # Wer den Pfad vorher nicht schon per Explorer oder "net use" verbunden
+    # hatte, bekam deshalb einen irreführenden "nicht erreichbar"-Fehler, auch
+    # wenn Pfad und Zugangsdaten korrekt waren. Deshalb hier selbst nachfragen
+    # und die Sitzung aufbauen, statt das als manuellen Vorschritt vorauszusetzen.
+    if ($Ziel -match '^\\\\') {
+        Warnung "Kein Zugriff auf $Ziel - vermutlich fehlt die Anmeldung am Samba-Share."
+        Write-Host ""
+        $nutzer = Read-Host "  Benutzername [homeassistant]"
+        if (-not $nutzer) { $nutzer = "homeassistant" }
+        $kennwortSicher = Read-Host "  Kennwort" -AsSecureString
+        $kennwort = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto(
+            [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($kennwortSicher))
+
+        # Eine tote Verbindung von einem vorherigen Versuch würde den
+        # Neuaufbau blockieren - leise entfernen, falls vorhanden.
+        & net use $Ziel /delete /y *> $null
+
+        & net use $Ziel /user:$nutzer $kennwort
+        $kennwort = $null
+        if ($LASTEXITCODE -ne 0 -or -not (Test-Path $Ziel)) {
+            throw "Ziel nicht erreichbar: $Ziel - Anmeldung fehlgeschlagen oder Pfad falsch."
+        }
+        Gut "Angemeldet."
+    } else {
+        throw "Ziel nicht erreichbar: $Ziel - Pfad korrekt?"
+    }
 }
 
 # Ein config-Verzeichnis ohne configuration.yaml ist mit hoher Wahrscheinlichkeit