diff --git a/src/collections/Tenants.ts b/src/collections/Tenants.ts
index 601c96f..55dd974 100644
--- a/src/collections/Tenants.ts
+++ b/src/collections/Tenants.ts
@@ -220,7 +220,7 @@ export const Tenants: CollectionConfig = {
                     description: 'Leer lassen um bestehendes Passwort zu behalten',
                   },
                   access: {
-                    read: neverReadable, // Passwort nie in API-Response
+                    read: ({ req }) => !!req.user, // Admin kann lesen, API ohne Auth nicht
                   },
                   hooks: {
                     beforeChange: [