diff --git a/partials/structure/layout_start.php b/partials/structure/layout_start.php
index c961e14..31d918a 100755
--- a/partials/structure/layout_start.php
+++ b/partials/structure/layout_start.php
@@ -24,6 +24,29 @@ if ($currentModule) {
 <body data-theme="<?= e($theme) ?>">
   <div class="bg-orb orb-a"></div>
   <div class="bg-orb orb-b"></div>
+  <header class="topbar">
+    <div class="topbar-left">
+      <?php if ($currentModule && !empty($module['title'])): ?>
+        <h1 class="page-title"><?= e($module['title']) ?></h1>
+        <span class="pill">Modul</span>
+      <?php else: ?>
+        <h1 class="page-title"><?= htmlspecialchars(t('common.title'), ENT_QUOTES) ?></h1>
+        <span class="pill">Dashboard</span>
+      <?php endif; ?>
+    </div>
+    <div class="topbar-actions">
+      <?php if (auth_enabled() && auth_user()): ?>
+        <span class="pill"><?= e(auth_user()['email'] ?? '') ?></span>
+        <a class="nav-link" href="/auth/logout">Logout</a>
+      <?php elseif (auth_enabled()): ?>
+        <a class="nav-link" href="/auth/login">Login</a>
+      <?php endif; ?>
+      <a class="nav-link" href="/users">User</a>
+      <a class="nav-link" href="/modules">Module</a>
+      <a class="nav-link" href="/modules/install">Modul installieren/aktivieren</a>
+    </div>
+  </header>
+
   <div class="app-shell">
     <aside class="app-sidebar">
       <div class="brand">
@@ -34,8 +57,9 @@ if ($currentModule) {
         </div>
       </div>
 
-      <button class="sidebar-toggle" data-sidebar-toggle>
-        ☰
+      <button class="sidebar-toggle" data-sidebar-toggle aria-label="Menü ein-/ausklappen">
+        <span class="sidebar-icon">☰</span>
+        <span class="sidebar-collapse">»»</span>
       </button>
 
       <nav class="sidebar-nav">
@@ -54,28 +78,6 @@ if ($currentModule) {
     </aside>
 
     <div class="app-content">
-      <header class="topbar">
-        <div class="topbar-left">
-          <?php if ($currentModule && !empty($module['title'])): ?>
-            <h1 class="page-title"><?= e($module['title']) ?></h1>
-            <span class="pill">Modul</span>
-          <?php else: ?>
-            <h1 class="page-title"><?= htmlspecialchars(t('common.title'), ENT_QUOTES) ?></h1>
-            <span class="pill">Dashboard</span>
-          <?php endif; ?>
-        </div>
-        <div class="topbar-actions">
-          <?php if (auth_enabled() && auth_user()): ?>
-            <span class="pill"><?= e(auth_user()['email'] ?? '') ?></span>
-            <a class="nav-link" href="/auth/logout">Logout</a>
-          <?php elseif (auth_enabled()): ?>
-            <a class="nav-link" href="/auth/login">Login</a>
-          <?php endif; ?>
-          <a class="nav-link" href="/users">User</a>
-          <a class="nav-link" href="/modules">Module</a>
-          <a class="nav-link" href="/modules/install">Modul installieren/aktivieren</a>
-        </div>
-      </header>
 
       <?php if ($moduleMenu): ?>
         <div class="module-subnav">
diff --git a/public/assets/css/app.css b/public/assets/css/app.css
index 7b301aa..f9c03fa 100644
--- a/public/assets/css/app.css
+++ b/public/assets/css/app.css
@@ -79,7 +79,7 @@ body {
   display: grid;
   grid-template-columns: 260px 1fr;
   gap: 24px;
-  padding: 24px;
+  padding: 0 24px 24px;
 }
 
 .app-sidebar {
@@ -105,10 +105,17 @@ body {
   color: var(--text);
   font-weight: 700;
 }
+.sidebar-collapse { display: none; }
 
 .sidebar-collapsed .app-shell {
   grid-template-columns: 72px 1fr;
 }
+.sidebar-collapsed .sidebar-toggle {
+  padding: 6px 8px;
+  font-size: 14px;
+}
+.sidebar-collapsed .sidebar-icon { display: none; }
+.sidebar-collapsed .sidebar-collapse { display: inline; }
 .sidebar-collapsed .app-sidebar .brand-text,
 .sidebar-collapsed .app-sidebar .nav-section,
 .sidebar-collapsed .app-sidebar .nav-link {
@@ -187,10 +194,15 @@ body {
 }
 
 .topbar {
+  position: sticky;
+  top: 0;
+  z-index: 20;
+  margin: 0;
+  width: 100%;
   background: var(--panel);
   border: 1px solid var(--line);
-  border-radius: 16px;
-  padding: 16px 20px;
+  border-radius: 0;
+  padding: 16px 24px;
   display: flex;
   align-items: center;
   justify-content: space-between;
@@ -299,12 +311,12 @@ body {
 }
 
 @media (max-width: 1100px) {
-  .app-shell { grid-template-columns: 1fr; }
+  .app-shell { grid-template-columns: 1fr; padding: 0 18px 18px; }
   .app-sidebar { position: relative; top: 0; }
 }
 @media (max-width: 720px) {
   .grid { grid-template-columns: 1fr; }
-  .app-shell { padding: 18px; }
+  .topbar { flex-direction: column; align-items: flex-start; }
 }
 
 /* Minimal Tailwind-like utility support for existing templates */
diff --git a/public/page/auth_callback.php b/public/page/auth_callback.php
index 753e64a..89a37cf 100644
--- a/public/page/auth_callback.php
+++ b/public/page/auth_callback.php
@@ -26,6 +26,7 @@ $client = new OidcClient($config);
 $token = $client->exchangeCode($code);
 
 $idToken = (string)($token['id_token'] ?? '');
+$accessToken = (string)($token['access_token'] ?? '');
 if ($idToken === '') {
     echo '<div class="card">Kein ID Token erhalten.</div>';
     return;
@@ -36,6 +37,14 @@ $client->validateIdToken($claims, $nonce);
 unset($_SESSION['oidc_nonce']);
 
 $groups = $client->groupsFromClaims($claims);
+if (!$groups && $accessToken !== '') {
+    try {
+        $accessClaims = $client->decodeJwt($accessToken);
+        $groups = $client->groupsFromClaims($accessClaims);
+    } catch (\Throwable $e) {
+        // ignore access token decoding errors
+    }
+}
 $user = [
     'sub' => (string)($claims['sub'] ?? ''),
     'email' => (string)($claims['email'] ?? ''),
