diff --git a/src/Controller/Booking/Edit/IndexController.php b/src/Controller/Booking/Edit/IndexController.php
index b12ca90..9d81da7 100644
--- a/src/Controller/Booking/Edit/IndexController.php
+++ b/src/Controller/Booking/Edit/IndexController.php
@@ -17,7 +17,6 @@ use App\Form\BookingParticipantType;
 use App\Form\Model\BookingDto;
 use App\Form\Model\ParticipantEditDto;
 use App\Htmx\HxTrait;
-use App\Security\Crypt;
 use App\Service\BookingEditDataLoaderService;
 use App\Service\BookingEditDraftService;
 use App\Service\BookingFingerprintService;
@@ -56,7 +55,6 @@ class IndexController extends AbstractController
         private readonly BookingFingerprintService $fingerprintService,
         private readonly BookingSummaryDataService $summaryDataService,
         private readonly ParticipantCardDataService $participantCardService,
-        private readonly Crypt $crypt,
         private readonly LoggerInterface $logger,
     ) {
     }
@@ -70,12 +68,10 @@ class IndexController extends AbstractController
     {
         /** @var User $user */
         $user = $this->getUser();
-        $email = $user->getEmail();
-        $password = $this->crypt->decrypt($user->getPassword());
 
         // Load form data from session (or API on first load)
         try {
-            $bookingDto = $this->dataLoader->loadFormData($request, $id, $email, $password, $user);
+            $bookingDto = $this->dataLoader->loadFormData($request, $id, $user);
         } catch (TravelNotFoundException) {
             $this->addFlash('error', 'Reisedaten sind nicht (mehr) verfügbar');
 
@@ -94,7 +90,7 @@ class IndexController extends AbstractController
         }
 
         // Fetch booking data for display (surcharges, canceled status, etc.)
-        $bookingData = $this->dataLoader->fetchBookingData($email, $password, $id, $user);
+        $bookingData = $this->dataLoader->fetchBookingData($id, $user);
         if (null === $bookingData || $bookingData instanceof Notification) {
             $this->addFlash('error', 'Buchungsdaten nicht (mehr) verfügbar');
 
@@ -110,7 +106,7 @@ class IndexController extends AbstractController
 
         // Handle form submission (clicking "Buchung aktualisieren")
         if ($form->isSubmitted() && $form->isValid()) {
-            return $this->handleFormSubmission($request, $bookingDto, $id, $email, $user);
+            return $this->handleFormSubmission($request, $bookingDto, $id, $user);
         }
 
         // Always generate card data with validation state to show completeness
@@ -147,8 +143,6 @@ class IndexController extends AbstractController
     {
         /** @var User $user */
         $user = $this->getUser();
-        $email = $user->getEmail();
-        $password = $this->crypt->decrypt($user->getPassword());
 
         // Load form data from session
         $bookingDto = $this->bookingService->getBookingDto($request, BookingDto::MODE_EDIT);
@@ -166,7 +160,7 @@ class IndexController extends AbstractController
         }
 
         // Fetch booking data to check for canceled status
-        $bookingData = $this->dataLoader->fetchBookingData($email, $password, $id, $user);
+        $bookingData = $this->dataLoader->fetchBookingData($id, $user);
         if (null === $bookingData || $bookingData instanceof Notification) {
             $this->addFlash('error', 'Buchungsdaten nicht (mehr) verfügbar');
 
@@ -255,8 +249,6 @@ class IndexController extends AbstractController
     {
         /** @var User $user */
         $user = $this->getUser();
-        $email = $user->getEmail();
-        $password = $this->crypt->decrypt($user->getPassword());
 
         // Load form data from session
         $bookingDto = $this->bookingService->getBookingDto($request, BookingDto::MODE_EDIT);
@@ -269,7 +261,7 @@ class IndexController extends AbstractController
         $this->travelDataService->enrichWithFreshAvailabilities($bookingDto->travel);
 
         // Fetch booking data and mutable data
-        $bookingData = $this->dataLoader->fetchBookingData($email, $password, $id, $user);
+        $bookingData = $this->dataLoader->fetchBookingData($id, $user);
         $mutableData = null !== $bookingData && !($bookingData instanceof Notification)
             ? $this->travelDataService->getMutabilityData($bookingData->dateId)
             : null;
@@ -394,8 +386,10 @@ class IndexController extends AbstractController
     /**
      * Handles form submission for booking update.
      */
-    private function handleFormSubmission(Request $request, BookingDto $bookingDto, int $id, string $email, User $user): Response
+    private function handleFormSubmission(Request $request, BookingDto $bookingDto, int $id, User $user): Response
     {
+        $email = $user->getEmail();
+
         $this->logger->info('Initiated booking update', [
             'email' => $email,
             'booking_id' => $id,
diff --git a/src/Service/BookingEditDataLoaderService.php b/src/Service/BookingEditDataLoaderService.php
index cbf65df..acd8505 100644
--- a/src/Service/BookingEditDataLoaderService.php
+++ b/src/Service/BookingEditDataLoaderService.php
@@ -10,6 +10,7 @@ use App\BusProNet\Model\Booking;
 use App\BusProNet\Model\Notification;
 use App\Entity\User;
 use App\Form\Model\BookingDto;
+use App\Security\Crypt;
 use Psr\Cache\InvalidArgumentException;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Contracts\Cache\ItemInterface;
@@ -34,6 +35,7 @@ class BookingEditDataLoaderService
         private readonly BookingFingerprintService $fingerprintService,
         private readonly TravelDataService $travelDataService,
         private readonly BookingEditDraftService $draftService,
+        private readonly Crypt $crypt,
         private readonly TagAwareCacheInterface $bpnCache,
     ) {
     }
@@ -58,13 +60,11 @@ class BookingEditDataLoaderService
      *
      * @param Request $request   The HTTP request
      * @param int     $bookingId The booking ID to load
-     * @param string  $email     User email for API authentication
-     * @param string  $password  User password for API authentication
-     * @param User    $user      The authenticated user (for draft lookup)
+     * @param User    $user      The authenticated user
      *
      * @return BookingDto|null The loaded booking DTO, or null if loading failed
      */
-    public function loadFormData(Request $request, int $bookingId, string $email, string $password, User $user): ?BookingDto
+    public function loadFormData(Request $request, int $bookingId, User $user): ?BookingDto
     {
         $this->draftWasRestored = false;
 
@@ -77,7 +77,7 @@ class BookingEditDataLoaderService
         }
 
         if (null === $formData) {
-            return $this->initializeFromApi($request, $bookingId, $email, $password, $user);
+            return $this->initializeFromApi($request, $bookingId, $user);
         }
 
         // Refresh availability data
@@ -95,15 +95,13 @@ class BookingEditDataLoaderService
      *
      * @param Request $request   The HTTP request
      * @param int     $bookingId The booking ID to load
-     * @param string  $email     User email for API authentication
-     * @param string  $password  User password for API authentication
-     * @param User    $user      The authenticated user (for draft lookup)
+     * @param User    $user      The authenticated user
      *
      * @return BookingDto|null The loaded booking DTO, or null if loading failed
      */
-    public function initializeFromApi(Request $request, int $bookingId, string $email, string $password, User $user): ?BookingDto
+    public function initializeFromApi(Request $request, int $bookingId, User $user): ?BookingDto
     {
-        $bookingData = $this->fetchBookingData($email, $password, $bookingId, $user);
+        $bookingData = $this->fetchBookingData($bookingId, $user);
 
         if (null === $bookingData || $bookingData instanceof Notification) {
             return null;
@@ -151,17 +149,17 @@ class BookingEditDataLoaderService
      * Cache entries are tagged with the user ID to allow bulk invalidation
      * when the user updates their personal data.
      *
-     * @param string $email     User email for API authentication
-     * @param string $password  User password for API authentication
-     * @param int    $bookingId The booking ID to fetch
-     * @param User   $user      The user for cache tagging
+     * @param int  $bookingId The booking ID to fetch
+     * @param User $user      The authenticated user
      *
      * @return Booking|Notification|null The booking data, notification on error, or null on cache failure
      */
-    public function fetchBookingData(string $email, string $password, int $bookingId, User $user): Booking|Notification|null
+    public function fetchBookingData(int $bookingId, User $user): Booking|Notification|null
     {
         $cacheKey = sprintf('bpn_booking_%d', $bookingId);
         $userTag = self::CACHE_TAG_USER_PREFIX.$user->getId();
+        $email = $user->getEmail();
+        $password = $this->crypt->decrypt($user->getPassword());
 
         try {
             return $this->bpnCache->get($cacheKey, function (ItemInterface $item) use ($email, $password, $bookingId, $userTag) {