diff --git a/shop/lib/actions/auth.ts b/shop/lib/actions/auth.ts
index 23d255a..8b45ce3 100644
--- a/shop/lib/actions/auth.ts
+++ b/shop/lib/actions/auth.ts
@@ -3,6 +3,7 @@
 import { createClient } from '@/lib/supabase/server'
 import { createAdminClient } from '@/lib/supabase/admin'
 import { headers } from 'next/headers'
+import { sendLockoutEmail } from '@/lib/utils/email'
 
 export async function signIn(email: string, password: string) {
   try {
@@ -12,6 +13,32 @@ export async function signIn(email: string, password: string) {
       password,
     })
     if (error) {
+      // Track failed attempts
+      const { data: usr, error: usrError } = await supabase
+        .from('users')
+        .select('failed_attempts, email')
+        .eq('email', email)
+        .single()
+
+      const attempts = (usr?.failed_attempts ?? 0) + 1
+
+      // Update attempts count
+      await supabase
+        .from('users')
+        .update({ failed_attempts: attempts })
+        .eq('email', email)
+
+      // Lock account on 5th failure
+      if (attempts >= 5) {
+        await supabase
+          .from('users')
+          .update({ role: 'gesperrt' })
+          .eq('email', email)
+        // Notify admin
+        await sendLockoutEmail('info@hephex.de')
+        return { success: false, error: 'Konto gesperrt nach 5 Fehlversuchen.' }
+      }
+
       return { success: false, error: error.message }
     }
 
diff --git a/shop/lib/utils/email.ts b/shop/lib/utils/email.ts
new file mode 100644
index 0000000..ab3dcca
--- /dev/null
+++ b/shop/lib/utils/email.ts
@@ -0,0 +1,25 @@
+'use server'
+
+import nodemailer from 'nodemailer'
+
+export async function sendLockoutEmail(to: string) {
+  const transporter = nodemailer.createTransport({
+    host: process.env.SMTP_HOST,
+    port: Number(process.env.SMTP_PORT),
+    secure: process.env.SMTP_SECURE === 'true',
+    auth: {
+      user: process.env.SMTP_USER,
+      pass: process.env.SMTP_PASS,
+    },
+  })
+
+  const message = {
+    from: `"Admin" <${process.env.SMTP_FROM}>`,
+    to,
+    subject: 'Konto gesperrt',
+    text: 'Ihr Konto wurde wegen zu vieler falscher Passwortversuche gesperrt.',
+    html: `<p>Ihr Konto wurde gesperrt, weil das Passwort zu oft falsch eingegeben wurde.</p>`,
+  }
+
+  await transporter.sendMail(message)
+}