diff --git a/deploy/self-repair.sh b/deploy/self-repair.sh
index 097e310..9299b5f 100644
--- a/deploy/self-repair.sh
+++ b/deploy/self-repair.sh
@@ -60,7 +60,7 @@ CHANGED=""; SKIPPED=""
 for leaf in $LEAVES; do
   if echo "$leaf" | grep -qiE "$SEC_RX"; then SKIPPED="$SKIPPED $leaf(security-tabu)"; continue; fi
   # Nur EINDEUTIGE Schlüssel-Zeilen (genau 1×) anfassen — Mehrdeutige sind zu riskant.
-  n="$(grep -cE "^[[:space:]]*${leaf}:" "$CFG" 2>/dev/null || echo 0)"
+  n=$(grep -cE "^[[:space:]]*${leaf}:" "$CFG" 2>/dev/null); n=${n:-0}
   if [ "$n" = "1" ]; then
     sed -i -E "s|^([[:space:]]*)(${leaf}:.*)$|\1# [selbstrepariert $(date +%F)] \2|" "$CFG"
     CHANGED="$CHANGED $leaf"; say "auskommentiert: $leaf (unbekannt/veraltet)"