diff --git a/jobs/cf_estate_sync.py b/jobs/cf_estate_sync.py
index 7d623e5..aa33cf4 100644
--- a/jobs/cf_estate_sync.py
+++ b/jobs/cf_estate_sync.py
@@ -127,8 +127,10 @@ class CFEstateSync(Job):
         if not ok:
             skipped.append("connectivity/directory/services")
         for v in (vpc or []):
-            services.append((v.get("name") or v.get("id"), "Cloudflare VPC Service", "VPC-Service",
-                             {"service_id": v.get("id"), "type": v.get("type")}, "service_id", v.get("id")))
+            # VPC-Directory-Services tragen ihren Identifier in "service_id" (NICHT "id").
+            sid = v.get("service_id") or v.get("id")
+            services.append((v.get("name") or sid, "Cloudflare VPC Service", "VPC-Service",
+                             {"service_id": sid, "type": v.get("type")}, "service_id", sid))
 
         ok, rts = self._cf_get(f"/accounts/{A}/teamnet/routes?per_page=50")
         if not ok:
@@ -141,6 +143,11 @@ class CFEstateSync(Job):
 
     # ---------------------------------------------------------------- ORM-Upsert
     def _upsert(self, model, cache, name, rt, acct, desc, extra, mk, mv, label, seen, dryrun):
+        # mv=None nie matchen: sonst greift .get(mk)==None auf das erste Objekt OHNE mk
+        # und mischt fremde extra_config zusammen (z.B. VPC ohne id -> App-Launcher).
+        if mv is None:
+            self.logger.warning("~ %s '%s' ohne Match-Wert (%s) — uebersprungen", label, name, mk)
+            return None
         ex = next((o for o in cache if (o.extra_config or {}).get(mk) == mv), None)
         if ex:
             seen.add(ex.id)