diff --git a/VERSION b/VERSION
index 4f706ff..2d53f23 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.1.149
+1.1.150
diff --git a/cmd/edgeguard-api/main.go b/cmd/edgeguard-api/main.go
index 01c1391..08bae31 100644
--- a/cmd/edgeguard-api/main.go
+++ b/cmd/edgeguard-api/main.go
@@ -60,7 +60,7 @@ import (
 	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
 )
 
-var version = "1.1.149"
+var version = "1.1.150"
 
 func main() {
 	addr := os.Getenv("EDGEGUARD_API_ADDR")
diff --git a/cmd/edgeguard-ctl/main.go b/cmd/edgeguard-ctl/main.go
index 93ab115..2e549b1 100644
--- a/cmd/edgeguard-ctl/main.go
+++ b/cmd/edgeguard-ctl/main.go
@@ -11,7 +11,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
 )
 
-var version = "1.1.149"
+var version = "1.1.150"
 
 const usage = `edgeguard-ctl — EdgeGuard CLI
 
diff --git a/cmd/edgeguard-scheduler/main.go b/cmd/edgeguard-scheduler/main.go
index f3202af..ea8f031 100644
--- a/cmd/edgeguard-scheduler/main.go
+++ b/cmd/edgeguard-scheduler/main.go
@@ -41,7 +41,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
 )
 
-var version = "1.1.149"
+var version = "1.1.150"
 
 const (
 	// renewTickInterval — how often we re-evaluate expiring certs.
diff --git a/internal/handlers/setup.go b/internal/handlers/setup.go
index ace0375..f569230 100644
--- a/internal/handlers/setup.go
+++ b/internal/handlers/setup.go
@@ -165,6 +165,7 @@ func (h *SetupHandler) JoinCluster(c *gin.Context) {
 		Token:       strings.TrimSpace(body.Token),
 		CommonName:  fqdn,
 		Insecure:    body.Insecure,
+		Force:       true, // bootstrap self-signed cert must be replaced
 		Version:     h.Version,
 		NodeID:      h.NodeID,
 	}); err != nil {
diff --git a/internal/services/clusterjoin/join.go b/internal/services/clusterjoin/join.go
index 228adc7..404edb9 100644
--- a/internal/services/clusterjoin/join.go
+++ b/internal/services/clusterjoin/join.go
@@ -38,6 +38,11 @@ type Request struct {
 	// because security depends on the HMAC-signed token, not TLS trust.
 	Insecure bool
 
+	// Force overwrites existing peer cert material. The CLI keeps this
+	// false (explicit rm required); the setup-wizard handler sets it
+	// true because the bootstrap self-signed cert must be replaced.
+	Force bool
+
 	// TLSDir is where ca.crt + peer.{crt,key} are written.
 	// Zero value → clustertls.DefaultDir.
 	TLSDir string
@@ -73,7 +78,7 @@ func Join(req Request) error {
 	}
 
 	store := clustertls.New(tlsDir)
-	if store.HasPeer() {
+	if store.HasPeer() && !req.Force {
 		return fmt.Errorf("peer cert already present under %s — remove it first if this is intentional", tlsDir)
 	}