diff --git a/.env.example b/.env.example
index 1d3d611..2d54e04 100644
--- a/.env.example
+++ b/.env.example
@@ -73,6 +73,24 @@ TELEPHONY_DEV_SIP_PORT=5060
 TELEPHONY_DEV_RTP_MIN_PORT=10000
 TELEPHONY_DEV_RTP_MAX_PORT=10020
 
+# Externe Telefonie über Telekom/tel.t-online.de. Keine echten Zugangsdaten
+# einchecken. SIP-ID ist in der Regel die Rufnummer mit Vorwahl ohne Leerzeichen
+# und ohne Sonderzeichen, z. B. 0301234567. Wenn dein Anschluss noch die
+# Internet-Zugangsdaten als Auth-User nutzt, kann TELEPHONY_TELEKOM_AUTH_USER
+# aus Anschlusskennung + Zugangsnummer + # + Mitbenutzernummer + @t-online.de
+# gebildet werden.
+TELEPHONY_EXTERNAL_PROVIDER=
+TELEPHONY_EXTERNAL_ENABLED=false
+TELEPHONY_EXTERNAL_INBOUND_EXTENSION=1001
+TELEPHONY_TELEKOM_ENABLED=false
+TELEPHONY_TELEKOM_REGISTRAR=tel.t-online.de
+TELEPHONY_TELEKOM_SIP_USER=
+TELEPHONY_TELEKOM_AUTH_USER=
+TELEPHONY_TELEKOM_PASSWORD=
+TELEPHONY_TELEKOM_CALLER_ID=
+TELEPHONY_TELEKOM_INBOUND_EXTENSION=1001
+TELEPHONY_TELEKOM_OUTBOUND_PREFIX=0
+
 # Optionaler Erststart-Bootstrap. Wenn gesetzt, werden Admin, Mandant,
 # Admin-Rolle und Grunddaten beim Backend-Start idempotent angelegt.
 FEDEO_BOOTSTRAP_ADMIN_EMAIL=admin@example.com
diff --git a/backend/src/routes/telephony.ts b/backend/src/routes/telephony.ts
index fc9cf19..3acd0af 100644
--- a/backend/src/routes/telephony.ts
+++ b/backend/src/routes/telephony.ts
@@ -43,6 +43,32 @@ const testAccounts = () => [
     },
 ]
 
+const externalTelephonyConfig = () => {
+    const provider = process.env.TELEPHONY_EXTERNAL_PROVIDER || (
+        envFlag(process.env.TELEPHONY_TELEKOM_ENABLED, false) ? "telekom" : ""
+    )
+    const enabled = envFlag(
+        process.env.TELEPHONY_EXTERNAL_ENABLED,
+        envFlag(process.env.TELEPHONY_TELEKOM_ENABLED, false)
+    )
+
+    return {
+        enabled,
+        provider: provider || null,
+        inboundExtension: process.env.TELEPHONY_EXTERNAL_INBOUND_EXTENSION
+            || process.env.TELEPHONY_TELEKOM_INBOUND_EXTENSION
+            || "1001",
+        outboundPrefix: process.env.TELEPHONY_TELEKOM_OUTBOUND_PREFIX || "0",
+        registrar: provider === "telekom" || envFlag(process.env.TELEPHONY_TELEKOM_ENABLED, false)
+            ? (process.env.TELEPHONY_TELEKOM_REGISTRAR || "tel.t-online.de")
+            : null,
+        sipUserConfigured: Boolean(process.env.TELEPHONY_TELEKOM_SIP_USER),
+        authUserConfigured: Boolean(process.env.TELEPHONY_TELEKOM_AUTH_USER),
+        passwordConfigured: Boolean(process.env.TELEPHONY_TELEKOM_PASSWORD),
+        callerIdConfigured: Boolean(process.env.TELEPHONY_TELEKOM_CALLER_ID),
+    }
+}
+
 const fetchWithTimeout = async (url: string, timeoutMs = 2500) => {
     const controller = new AbortController()
     const timeout = setTimeout(() => controller.abort(), timeoutMs)
@@ -89,6 +115,7 @@ export default async function telephonyRoutes(server: FastifyInstance) {
         sipWebSocketUrl: publicAsteriskWsUrl(),
         echoExtension: process.env.TELEPHONY_ECHO_EXTENSION || "600",
         testAccounts: testAccounts(),
+        external: externalTelephonyConfig(),
     }))
 
     server.get("/telephony/status", async () => {
diff --git a/docker-compose.yml b/docker-compose.yml
index fc33659..a6187b4 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -66,6 +66,9 @@ services:
       - TELEPHONY_TEST_EXTENSION_2=${TELEPHONY_TEST_EXTENSION_2:-1002}
       - TELEPHONY_TEST_PASSWORD_2=${TELEPHONY_TEST_PASSWORD_2:-fedeo-test-1002}
       - TELEPHONY_ECHO_EXTENSION=${TELEPHONY_ECHO_EXTENSION:-600}
+      - TELEPHONY_EXTERNAL_PROVIDER=${TELEPHONY_EXTERNAL_PROVIDER:-}
+      - TELEPHONY_EXTERNAL_ENABLED=${TELEPHONY_EXTERNAL_ENABLED:-false}
+      - TELEPHONY_EXTERNAL_INBOUND_EXTENSION=${TELEPHONY_EXTERNAL_INBOUND_EXTENSION:-1001}
     networks:
       - traefik
     labels:
@@ -106,8 +109,24 @@ services:
     restart: unless-stopped
     profiles:
       - telephony-dev
+    environment:
+      - TELEPHONY_TELEKOM_ENABLED=${TELEPHONY_TELEKOM_ENABLED:-false}
+      - TELEPHONY_TELEKOM_REGISTRAR=${TELEPHONY_TELEKOM_REGISTRAR:-tel.t-online.de}
+      - TELEPHONY_TELEKOM_SIP_USER=${TELEPHONY_TELEKOM_SIP_USER:-}
+      - TELEPHONY_TELEKOM_AUTH_USER=${TELEPHONY_TELEKOM_AUTH_USER:-}
+      - TELEPHONY_TELEKOM_PASSWORD=${TELEPHONY_TELEKOM_PASSWORD:-}
+      - TELEPHONY_TELEKOM_CALLER_ID=${TELEPHONY_TELEKOM_CALLER_ID:-}
+      - TELEPHONY_TELEKOM_INBOUND_EXTENSION=${TELEPHONY_TELEKOM_INBOUND_EXTENSION:-1001}
+      - TELEPHONY_TELEKOM_OUTBOUND_PREFIX=${TELEPHONY_TELEKOM_OUTBOUND_PREFIX:-0}
+      - ASTERISK_GENERATED_DIR=/etc/asterisk/generated
+    command:
+      - /bin/sh
+      - -c
+      - /usr/local/bin/render-asterisk-config.sh && asterisk -f
     volumes:
       - ./telephony/asterisk:/etc/asterisk:ro
+      - asterisk-generated:/etc/asterisk/generated
+      - ./telephony/render-asterisk-config.sh:/usr/local/bin/render-asterisk-config.sh:ro
     ports:
       - "${TELEPHONY_DEV_WS_PORT:-8088}:8088"
       - "${TELEPHONY_DEV_SIP_PORT:-5060}:5060/udp"
@@ -465,3 +484,6 @@ services:
 networks:
   traefik:
     external: false
+
+volumes:
+  asterisk-generated:
diff --git a/docs/telekom-telefonie.md b/docs/telekom-telefonie.md
new file mode 100644
index 0000000..a9f33a4
--- /dev/null
+++ b/docs/telekom-telefonie.md
@@ -0,0 +1,40 @@
+# Telekom-Telefonie in FEDEO
+
+FEDEO kann den lokalen Asterisk-Stack als Übergang zur externen Telefonie nutzen. Die Telekom-Anbindung wird aus Umgebungsvariablen erzeugt, damit Zugangsdaten nicht im Repository landen.
+
+## Zugangsdaten
+
+Für Telekom-SIP ist der Registrar normalerweise `tel.t-online.de`. Die SIP-ID ist in der Regel die Rufnummer mit Vorwahl ohne Leerzeichen und Sonderzeichen, zum Beispiel `0301234567`.
+
+Wenn dein Anschluss statt einer separaten SIP-ID die klassischen Zugangsdaten nutzt, kann der Authentifizierungsnutzer aus Anschlusskennung, Zugangsnummer, Mitbenutzernummer und `@t-online.de` gebildet werden:
+
+```env
+TELEPHONY_TELEKOM_AUTH_USER=<anschlusskennung><zugangsnummer>#<mitbenutzernummer>@t-online.de
+```
+
+## `.env`
+
+```env
+TELEPHONY_ENABLED=true
+TELEPHONY_EXTERNAL_PROVIDER=telekom
+TELEPHONY_EXTERNAL_ENABLED=true
+
+TELEPHONY_TELEKOM_ENABLED=true
+TELEPHONY_TELEKOM_REGISTRAR=tel.t-online.de
+TELEPHONY_TELEKOM_SIP_USER=<rufnummer_mit_vorwahl_ohne_sonderzeichen>
+TELEPHONY_TELEKOM_AUTH_USER=
+TELEPHONY_TELEKOM_PASSWORD=<persönliches_kennwort_oder_sip_kennwort>
+TELEPHONY_TELEKOM_CALLER_ID=<rufnummer_mit_vorwahl_ohne_sonderzeichen>
+TELEPHONY_TELEKOM_INBOUND_EXTENSION=1001
+TELEPHONY_TELEKOM_OUTBOUND_PREFIX=0
+```
+
+Wenn `TELEPHONY_TELEKOM_AUTH_USER` leer bleibt, verwendet Asterisk automatisch `TELEPHONY_TELEKOM_SIP_USER` als Authentifizierungsnutzer.
+
+## Start
+
+```bash
+docker compose --profile telephony-dev up -d asterisk-dev
+```
+
+Beim Start erzeugt der Container die Dateien `pjsip.telekom.conf` und `extensions.telekom.conf` in einem Docker-Volume. Ausgehende Anrufe mit Prefix `0` und internationale Ziele mit `+` werden über den Telekom-Trunk geroutet. Eingehende Anrufe landen standardmäßig auf Nebenstelle `1001`.
diff --git a/frontend/pages/communication/phone-setup.vue b/frontend/pages/communication/phone-setup.vue
index 286ed48..b6933fd 100644
--- a/frontend/pages/communication/phone-setup.vue
+++ b/frontend/pages/communication/phone-setup.vue
@@ -58,6 +58,93 @@ onMounted(loadTelephony)
         </div>
       </div>
 
+      <UCard>
+        <template #header>
+          <div class="flex flex-col gap-3 lg:flex-row lg:items-center lg:justify-between">
+            <div>
+              <h2 class="text-base font-semibold text-gray-950">
+                Externe Telefonie
+              </h2>
+              <p class="mt-1 text-sm text-gray-500">
+                Telekom-Anbindung über den lokalen Asterisk-Trunk.
+              </p>
+            </div>
+            <UBadge :color="config?.external?.enabled ? 'success' : 'neutral'" variant="soft">
+              {{ config?.external?.enabled ? "Aktiviert" : "Deaktiviert" }}
+            </UBadge>
+          </div>
+        </template>
+
+        <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-4">
+          <div class="rounded-lg border border-gray-200 bg-white p-4">
+            <div class="flex items-center gap-2">
+              <UIcon name="i-heroicons-building-office-2" class="text-gray-500" />
+              <span class="text-sm font-medium text-gray-700">Provider</span>
+            </div>
+            <p class="mt-3 text-lg font-semibold text-gray-950">
+              {{ config?.external?.provider || "-" }}
+            </p>
+          </div>
+
+          <div class="rounded-lg border border-gray-200 bg-white p-4">
+            <div class="flex items-center gap-2">
+              <UIcon name="i-heroicons-globe-alt" class="text-gray-500" />
+              <span class="text-sm font-medium text-gray-700">Registrar</span>
+            </div>
+            <p class="mt-3 break-all font-mono text-sm font-semibold text-gray-950">
+              {{ config?.external?.registrar || "-" }}
+            </p>
+          </div>
+
+          <div class="rounded-lg border border-gray-200 bg-white p-4">
+            <div class="flex items-center gap-2">
+              <UIcon name="i-heroicons-phone-arrow-down-left" class="text-gray-500" />
+              <span class="text-sm font-medium text-gray-700">Eingehend</span>
+            </div>
+            <p class="mt-3 text-lg font-semibold text-gray-950">
+              {{ config?.external?.inboundExtension || "-" }}
+            </p>
+          </div>
+
+          <div class="rounded-lg border border-gray-200 bg-white p-4">
+            <div class="flex items-center gap-2">
+              <UIcon name="i-heroicons-phone-arrow-up-right" class="text-gray-500" />
+              <span class="text-sm font-medium text-gray-700">Ausgehend</span>
+            </div>
+            <p class="mt-3 text-lg font-semibold text-gray-950">
+              Prefix {{ config?.external?.outboundPrefix || "0" }}
+            </p>
+          </div>
+        </div>
+
+        <div class="mt-4 grid gap-3 sm:grid-cols-2 lg:grid-cols-4">
+          <UAlert
+            :color="config?.external?.sipUserConfigured ? 'success' : 'warning'"
+            :icon="config?.external?.sipUserConfigured ? 'i-heroicons-check-circle' : 'i-heroicons-exclamation-triangle'"
+            title="SIP-ID"
+            :description="config?.external?.sipUserConfigured ? 'Konfiguriert' : 'Fehlt'"
+          />
+          <UAlert
+            :color="config?.external?.passwordConfigured ? 'success' : 'warning'"
+            :icon="config?.external?.passwordConfigured ? 'i-heroicons-check-circle' : 'i-heroicons-exclamation-triangle'"
+            title="Kennwort"
+            :description="config?.external?.passwordConfigured ? 'Konfiguriert' : 'Fehlt'"
+          />
+          <UAlert
+            :color="config?.external?.authUserConfigured ? 'success' : 'neutral'"
+            :icon="config?.external?.authUserConfigured ? 'i-heroicons-check-circle' : 'i-heroicons-information-circle'"
+            title="Auth-User"
+            :description="config?.external?.authUserConfigured ? 'Konfiguriert' : 'Optional'"
+          />
+          <UAlert
+            :color="config?.external?.callerIdConfigured ? 'success' : 'neutral'"
+            :icon="config?.external?.callerIdConfigured ? 'i-heroicons-check-circle' : 'i-heroicons-information-circle'"
+            title="Absendernummer"
+            :description="config?.external?.callerIdConfigured ? 'Konfiguriert' : 'Optional'"
+          />
+        </div>
+      </UCard>
+
       <div class="grid gap-4 lg:grid-cols-[1.1fr_0.9fr]">
         <UCard>
           <template #header>
diff --git a/telephony/asterisk/extensions.conf b/telephony/asterisk/extensions.conf
index 054cefb..131a58e 100644
--- a/telephony/asterisk/extensions.conf
+++ b/telephony/asterisk/extensions.conf
@@ -13,3 +13,5 @@ exten => 1002,1,Dial(PJSIP/1002,30)
 exten => 600,1,Answer()
  same => n,Echo()
  same => n,Hangup()
+
+#tryinclude generated/extensions.telekom.conf
diff --git a/telephony/asterisk/pjsip.conf b/telephony/asterisk/pjsip.conf
index 15e9542..bc91196 100644
--- a/telephony/asterisk/pjsip.conf
+++ b/telephony/asterisk/pjsip.conf
@@ -65,3 +65,5 @@ type=aor
 max_contacts=5
 remove_existing=yes
 support_path=yes
+
+#tryinclude generated/pjsip.telekom.conf
diff --git a/telephony/render-asterisk-config.sh b/telephony/render-asterisk-config.sh
new file mode 100755
index 0000000..1b0f8e5
--- /dev/null
+++ b/telephony/render-asterisk-config.sh
@@ -0,0 +1,114 @@
+#!/bin/sh
+set -eu
+
+GENERATED_DIR="${ASTERISK_GENERATED_DIR:-/etc/asterisk/generated}"
+mkdir -p "$GENERATED_DIR"
+
+PJSIP_FILE="$GENERATED_DIR/pjsip.telekom.conf"
+EXTENSIONS_FILE="$GENERATED_DIR/extensions.telekom.conf"
+
+enabled="${TELEPHONY_TELEKOM_ENABLED:-false}"
+
+if [ "$enabled" != "true" ] && [ "$enabled" != "1" ] && [ "$enabled" != "yes" ]; then
+  cat > "$PJSIP_FILE" <<'EOF'
+; Telekom-Anbindung ist deaktiviert.
+EOF
+  cat > "$EXTENSIONS_FILE" <<'EOF'
+; Telekom-Anbindung ist deaktiviert.
+EOF
+  exit 0
+fi
+
+registrar="${TELEPHONY_TELEKOM_REGISTRAR:-tel.t-online.de}"
+sip_user="${TELEPHONY_TELEKOM_SIP_USER:-}"
+auth_user="${TELEPHONY_TELEKOM_AUTH_USER:-$sip_user}"
+password="${TELEPHONY_TELEKOM_PASSWORD:-}"
+caller_id="${TELEPHONY_TELEKOM_CALLER_ID:-$sip_user}"
+inbound_extension="${TELEPHONY_TELEKOM_INBOUND_EXTENSION:-1001}"
+outbound_prefix="${TELEPHONY_TELEKOM_OUTBOUND_PREFIX:-0}"
+
+if [ -z "$sip_user" ] || [ -z "$password" ]; then
+  cat > "$PJSIP_FILE" <<'EOF'
+; Telekom-Anbindung ist aktiviert, aber TELEPHONY_TELEKOM_SIP_USER oder TELEPHONY_TELEKOM_PASSWORD fehlt.
+EOF
+  cat > "$EXTENSIONS_FILE" <<'EOF'
+; Telekom-Anbindung ist aktiviert, aber nicht vollständig konfiguriert.
+EOF
+  echo "FEDEO Telefonie: Telekom-Anbindung unvollständig, Trunk wird nicht erzeugt." >&2
+  exit 0
+fi
+
+cat > "$PJSIP_FILE" <<EOF
+; Automatisch aus Umgebungsvariablen erzeugt. Nicht in Git einchecken.
+
+[telekom-auth]
+type=auth
+auth_type=userpass
+username=$auth_user
+password=$password
+
+[telekom-aor]
+type=aor
+contact=sip:$registrar
+qualify_frequency=60
+
+[telekom]
+type=endpoint
+transport=transport-udp
+context=from-telekom
+disallow=all
+allow=alaw,ulaw
+aors=telekom-aor
+outbound_auth=telekom-auth
+from_user=$sip_user
+from_domain=$registrar
+callerid=Telekom <$caller_id>
+direct_media=no
+force_rport=yes
+rewrite_contact=yes
+rtp_symmetric=yes
+timers=no
+
+[telekom-registration]
+type=registration
+transport=transport-udp
+outbound_auth=telekom-auth
+server_uri=sip:$registrar
+client_uri=sip:$sip_user@$registrar
+contact_user=$sip_user
+retry_interval=60
+expiration=480
+line=yes
+endpoint=telekom
+
+[telekom-identify]
+type=identify
+endpoint=telekom
+match=$registrar
+EOF
+
+cat > "$EXTENSIONS_FILE" <<EOF
+; Automatisch aus Umgebungsvariablen erzeugt. Nicht in Git einchecken.
+
+[fedeo-local]
+exten => _${outbound_prefix}X.,1,NoOp(FEDEO ausgehend über Telekom: \${EXTEN})
+ same => n,Set(CALLERID(num)=$caller_id)
+ same => n,Dial(PJSIP/\${EXTEN}@telekom,60)
+ same => n,Hangup()
+
+exten => _+X.,1,NoOp(FEDEO ausgehend über Telekom: \${EXTEN})
+ same => n,Set(CALLERID(num)=$caller_id)
+ same => n,Dial(PJSIP/\${EXTEN}@telekom,60)
+ same => n,Hangup()
+
+[from-telekom]
+exten => s,1,NoOp(FEDEO eingehend über Telekom)
+ same => n,Dial(PJSIP/$inbound_extension,30)
+ same => n,Hangup()
+
+exten => _X!,1,NoOp(FEDEO eingehend über Telekom: \${EXTEN})
+ same => n,Dial(PJSIP/$inbound_extension,30)
+ same => n,Hangup()
+EOF
+
+echo "FEDEO Telefonie: Telekom-Trunk für $sip_user@$registrar erzeugt."