diff --git a/bootstrap/bootstrap.mjs b/bootstrap/bootstrap.mjs
index 687dfaf..a68cec4 100644
--- a/bootstrap/bootstrap.mjs
+++ b/bootstrap/bootstrap.mjs
@@ -1196,8 +1196,11 @@ async function applyPermissions() {
   // Public (Gast): nur aktive Kataloge lesen
   const pubPol = await ensurePolicy('Public (Skrift)', { app: false });
   await ensureAccess(null, pubPol.id);
-  for (const col of ['products', 'formats', 'motifs', 'price_items'])
+  for (const col of ['products', 'motifs', 'price_items'])
     await ensurePermission(pubPol.id, col, 'read', ['*'], { active: { _eq: true } });
+  // formats: aktiv (Konfigurator) ODER show_check (Textmengencheck). Sonst blieben die
+  // nicht öffentlich bestellbaren Check-Formate (A5, DIN lang) für Anonyme unsichtbar.
+  await ensurePermission(pubPol.id, 'formats', 'read', ['*'], { _or: [{ active: { _eq: true } }, { show_check: { _eq: true } }] });
   await ensurePermission(pubPol.id, 'pricing_settings', 'read');
 
   // Service (Backend + Produktion): Jobs/Orders lesen + Status schreiben