diff --git a/lib/api.js b/lib/api.js
index bd4cb73..f9909ea 100644
--- a/lib/api.js
+++ b/lib/api.js
@@ -95,12 +95,11 @@
 
         const t = await getToken();
         if (!t) return null;
-        const params = new URLSearchParams({ relpath });
+        // JWT als Query-Param, weil Apache auf prod den Authorization-Header filtert
+        const params = new URLSearchParams({ relpath, jwt: t });
         if (size) params.set('size', size);
 
-        const r = await fetch(API_BASE + '/photo.php?' + params.toString(), {
-            headers: { Authorization: 'Bearer ' + t },
-        });
+        const r = await fetch(API_BASE + '/photo.php?' + params.toString());
         if (!r.ok) {
             const body = await r.text().catch(() => '');
             console.warn('photo.php failed', r.status, relpath, body);