diff --git a/backend/src/app.ts b/backend/src/app.ts
index 1504328..1d999e7 100644
--- a/backend/src/app.ts
+++ b/backend/src/app.ts
@@ -7,6 +7,12 @@ import { authRouter } from './routes/auth';
 import { invitationsRouter } from './routes/invitations';
 import { ticketsRouter } from './routes/tickets';
 import { cleaningTasksRouter } from './routes/cleaningTasks';
+import { expensesRouter } from './routes/expenses';
+import { inventoryRouter } from './routes/inventory';
+import { handoverProtocolsRouter } from './routes/handoverProtocols';
+import { guestCodesRouter } from './routes/guestCodes';
+import { storageRouter } from './routes/storage';
+import { documentsRouter } from './routes/documents';
 
 export function createApp() {
   const app = express();
@@ -22,14 +28,22 @@ export function createApp() {
   // echten Produktivbetrieb sollte hier eine feste Allowlist stehen.
   app.use(cors({ origin: true }));
 
-  // Alle übrigen Routen bekommen normal geparstes JSON.
-  app.use(express.json());
+  // Alle übrigen Routen bekommen normal geparstes JSON. Limit angehoben, da
+  // die Inventarverwaltung mehrere Fotos als Data-URLs im Body versendet
+  // (keine separate Objekt-Storage-Anbindung in diesem Demo-Stand).
+  app.use(express.json({ limit: '10mb' }));
   app.use('/v1', paymentsRouter);
   app.use('/v1', cockpitRouter);
   app.use('/v1', authRouter);
   app.use('/v1', invitationsRouter);
   app.use('/v1', ticketsRouter);
   app.use('/v1', cleaningTasksRouter);
+  app.use('/v1', expensesRouter);
+  app.use('/v1', inventoryRouter);
+  app.use('/v1', handoverProtocolsRouter);
+  app.use('/v1', guestCodesRouter);
+  app.use('/v1', storageRouter);
+  app.use('/v1', documentsRouter);
 
   app.get('/health', (_req, res) => res.status(200).json({ ok: true }));