diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index 5174e3a..ce24bff 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -27,9 +27,14 @@ RUN uv python install 3.12 \
 # Trust the workspace bind mount (source on Windows FS -> uid mismatch)
 RUN git config --system --add safe.directory /workspaces/kirche-einfach
 
-# Pre-create named-volume targets (volumes inherit image content on first mount)
-RUN mkdir -p /workspaces/kirche-einfach/backend/.venv \
-             /workspaces/kirche-einfach/frontend/node_modules
+# Pre-create named-volume targets (volumes inherit image content on first mount).
+# The backend venv is created as `vscode` so VS Code's Python extension finds an
+# interpreter immediately on first attach, before postCreateCommand runs `uv sync`.
+USER vscode
+RUN mkdir -p /workspaces/kirche-einfach/backend \
+    && uv venv /workspaces/kirche-einfach/backend/.venv \
+    && mkdir -p /workspaces/kirche-einfach/frontend/node_modules
+USER root
 
 # opencode (as non-root user)
 USER vscode
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index b396724..a162f71 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -13,7 +13,7 @@
   "overrideCommand": false,
   "workspaceFolder": "/workspaces/kirche-einfach",
   "postCreateCommand": "sudo -E bash .devcontainer/setup.sh",
-  "postStartCommand": "mkdir -p ~/.ssh && cp /mnt/host-ssh/id_rsa /mnt/host-ssh/id_rsa.pub ~/.ssh/ && cp /mnt/host-ssh/known_hosts ~/.ssh/ 2>/dev/null; ssh-keyscan -t ed25519,rsa gitlab.jonas-miederer.com >> ~/.ssh/known_hosts 2>/dev/null; chmod 700 ~/.ssh && chmod 600 ~/.ssh/id_rsa && chmod 644 ~/.ssh/id_rsa.pub ~/.ssh/known_hosts",
+  "postStartCommand": "bash .devcontainer/postStart.sh",
   "customizations": {
     "vscode": {
       "extensions": [
diff --git a/.devcontainer/postStart.sh b/.devcontainer/postStart.sh
new file mode 100644
index 0000000..d1ec719
--- /dev/null
+++ b/.devcontainer/postStart.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+# Post-start hook: copies SSH keys from the host into the container, then
+# adds the git host. Never fails the devcontainer run: any missing file on
+# the host (e.g. no id_rsa) must not abort the lifecycle command.
+set -u
+
+mkdir -p ~/.ssh
+
+for f in id_rsa id_rsa.pub known_hosts; do
+  cp -f "/mnt/host-ssh/$f" ~/.ssh/ 2>/dev/null || true
+done
+
+ssh-keyscan -t ed25519,rsa gitlab.jonas-miederer.com >> ~/.ssh/known_hosts 2>/dev/null || true
+
+chmod 700 ~/.ssh 2>/dev/null || true
+chmod 600 ~/.ssh/id_rsa 2>/dev/null || true
+chmod 644 ~/.ssh/id_rsa.pub ~/.ssh/known_hosts 2>/dev/null || true
+
+exit 0
\ No newline at end of file