diff --git a/VERSION b/VERSION
index fade64b..350e5c8 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.1.159
+1.1.160
diff --git a/cmd/edgeguard-api/main.go b/cmd/edgeguard-api/main.go
index 044a924..7b18adb 100644
--- a/cmd/edgeguard-api/main.go
+++ b/cmd/edgeguard-api/main.go
@@ -60,7 +60,7 @@ import (
 	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
 )
 
-var version = "1.1.159"
+var version = "1.1.160"
 
 func main() {
 	addr := os.Getenv("EDGEGUARD_API_ADDR")
diff --git a/cmd/edgeguard-ctl/main.go b/cmd/edgeguard-ctl/main.go
index 97ba854..d35a7b6 100644
--- a/cmd/edgeguard-ctl/main.go
+++ b/cmd/edgeguard-ctl/main.go
@@ -11,7 +11,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
 )
 
-var version = "1.1.159"
+var version = "1.1.160"
 
 const usage = `edgeguard-ctl — EdgeGuard CLI
 
diff --git a/cmd/edgeguard-scheduler/main.go b/cmd/edgeguard-scheduler/main.go
index a2fedaa..ea0df2c 100644
--- a/cmd/edgeguard-scheduler/main.go
+++ b/cmd/edgeguard-scheduler/main.go
@@ -41,7 +41,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
 )
 
-var version = "1.1.159"
+var version = "1.1.160"
 
 const (
 	// renewTickInterval — how often we re-evaluate expiring certs.
diff --git a/internal/cluster/jointoken/jointoken.go b/internal/cluster/jointoken/jointoken.go
index 91a502d..892020b 100644
--- a/internal/cluster/jointoken/jointoken.go
+++ b/internal/cluster/jointoken/jointoken.go
@@ -61,12 +61,19 @@ type Service struct {
 }
 
 func New(pool *pgxpool.Pool, getCAFinger func() (string, error)) *Service {
-	return &Service{
+	s := &Service{
 		Pool:        pool,
 		SecretPath:  DefaultSecretPath,
 		GetCAFinger: getCAFinger,
 		TTL:         DefaultTTL,
 	}
+	// Ensure the HMAC secret file exists at startup so Consume() never
+	// fails with "no such file" on the first join attempt.
+	if _, err := s.ensureSecret(); err != nil {
+		// Non-fatal: generate won't work either, but we log and continue.
+		_ = err
+	}
+	return s
 }
 
 // payload ist das JSON inside-the-token.