diff --git a/VERSION b/VERSION
index 1b5cd17..d1887a0 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.1.112
+1.1.113
diff --git a/cmd/edgeguard-api/main.go b/cmd/edgeguard-api/main.go
index 96ac434..daefa4a 100644
--- a/cmd/edgeguard-api/main.go
+++ b/cmd/edgeguard-api/main.go
@@ -60,7 +60,7 @@ import (
 	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
 )
 
-var version = "1.1.112"
+var version = "1.1.113"
 
 func main() {
 	addr := os.Getenv("EDGEGUARD_API_ADDR")
diff --git a/cmd/edgeguard-ctl/main.go b/cmd/edgeguard-ctl/main.go
index 9ebbe5f..c8384b8 100644
--- a/cmd/edgeguard-ctl/main.go
+++ b/cmd/edgeguard-ctl/main.go
@@ -11,7 +11,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
 )
 
-var version = "1.1.112"
+var version = "1.1.113"
 
 const usage = `edgeguard-ctl — EdgeGuard CLI
 
diff --git a/cmd/edgeguard-scheduler/main.go b/cmd/edgeguard-scheduler/main.go
index 8565a18..8da6e19 100644
--- a/cmd/edgeguard-scheduler/main.go
+++ b/cmd/edgeguard-scheduler/main.go
@@ -41,7 +41,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
 )
 
-var version = "1.1.112"
+var version = "1.1.113"
 
 const (
 	// renewTickInterval — how often we re-evaluate expiring certs.
diff --git a/internal/handlers/haproxy_stats.go b/internal/handlers/haproxy_stats.go
index bb954ec..4a043c7 100644
--- a/internal/handlers/haproxy_stats.go
+++ b/internal/handlers/haproxy_stats.go
@@ -135,7 +135,7 @@ func (h *HAProxyStatsHandler) Stats(c *gin.Context) {
 }
 
 func safeAt(fields []string, i int) string {
-	if i <= 0 || i >= len(fields) {
+	if i < 0 || i >= len(fields) {
 		return ""
 	}
 	return fields[i]
diff --git a/internal/haproxy/haproxy.cfg.tpl b/internal/haproxy/haproxy.cfg.tpl
index ddd1799..0dbb3f1 100644
--- a/internal/haproxy/haproxy.cfg.tpl
+++ b/internal/haproxy/haproxy.cfg.tpl
@@ -15,6 +15,9 @@ global
     # Ohne dieses Flag verweigert HAProxy `bind quic4@…` mit "this SSL
     # library does not support the QUIC protocol".
     limited-quic
+    # Runtime-API-Socket für edgeguard-api (show stat, show info, …).
+    # mode 0660 + group haproxy → edgeguard-user (in haproxy-group) kann lesen.
+    stats socket /run/haproxy/admin.sock mode 0660 level admin expose-fd listeners
 
 defaults
     log     global