diff --git a/java/com.sap.sailing.server/src/com/sap/sailing/server/impl/Activator.java b/java/com.sap.sailing.server/src/com/sap/sailing/server/impl/Activator.java
index a3eba6ed3e0..c1580f0a265 100755
--- a/java/com.sap.sailing.server/src/com/sap/sailing/server/impl/Activator.java
+++ b/java/com.sap.sailing.server/src/com/sap/sailing/server/impl/Activator.java
@@ -245,18 +245,13 @@ public class Activator implements BundleActivator {
                             if (!replicationService.isReplicationStarting() && securityService.getMasterDescriptor() == null) {
                                 // see also bug 5569: this must only be done if it is clear that this instance is not to become a replica
                                 final RoleDefinition sailingViewerRoleDefinition = securityService
-                                        .getOrCreateRoleDefinitionFromPrototype(SailingViewerRole.getInstance());
+                                        .getOrCreateRoleDefinitionFromPrototype(SailingViewerRole.getInstance(), /* makeReadableForAll */ true);
                                 if (securityService.isNewServer()) {
                                     // The server is initially set to be public by adding sailing_viewer role to the server group
                                     // with forAll=true
                                     securityService.putRoleDefinitionToUserGroup(securityService.getServerGroup(),
                                             sailingViewerRoleDefinition, true);
                                 }
-                                if (securityService.isInitialOrMigration()) {
-                                    // sailing_viewer role is publicly readable
-                                    securityService.addToAccessControlList(sailingViewerRoleDefinition.getIdentifier(),
-                                            null, DefaultActions.READ.name());
-                                }
                             }
                         } catch (InterruptedException e) {
                             logger.log(Level.SEVERE, "Couldn't get a hold of the ReplicationService to tell whether this SecurityService is to become a replica; "+
@@ -267,9 +262,9 @@ public class Activator implements BundleActivator {
                     backgroundThread.start();
                     // TODO: Registering SubscriptionPlan specific RoleDefinitions here requires additional maintenance. Consider
                     // implementing another Construct like OSGIHasPermissionsProvider
-                    securityService.getOrCreateRoleDefinitionFromPrototype(PremiumRole.getInstance());
-                    securityService.getOrCreateRoleDefinitionFromPrototype(ArchiveDataMiningRole.getInstance());
-                    securityService.getOrCreateRoleDefinitionFromPrototype(AllDataMiningRole.getInstance());
+                    securityService.getOrCreateRoleDefinitionFromPrototype(PremiumRole.getInstance(), /* makeReadableForAll */ true);
+                    securityService.getOrCreateRoleDefinitionFromPrototype(ArchiveDataMiningRole.getInstance(), /* makeReadableForAll */ true);
+                    securityService.getOrCreateRoleDefinitionFromPrototype(AllDataMiningRole.getInstance(), /* makeReadableForAll */ true);
                 }, null));
         final TrackedRaceStatisticsCache trackedRaceStatisticsCache = new TrackedRaceStatisticsCacheImpl();
         registrations.add(context.registerService(TrackedRaceStatisticsCache.class.getName(),
diff --git a/java/com.sap.sse.security.test/src/com/sap/sse/security/test/LoginTest.java b/java/com.sap.sse.security.test/src/com/sap/sse/security/test/LoginTest.java
index 1c31ca0f9c9..f28dad8678d 100644
--- a/java/com.sap.sse.security.test/src/com/sap/sse/security/test/LoginTest.java
+++ b/java/com.sap.sse.security.test/src/com/sap/sse/security/test/LoginTest.java
@@ -176,14 +176,14 @@ public class LoginTest {
         final String username = "TheNewUser";
         final String password = "Humba";
         final User admin = securityService.getUserByName("admin");
-        final RoleDefinition adminRoleDefinition = securityService.getOrCreateRoleDefinitionFromPrototype(AdminRole.getInstance());
+        final RoleDefinition adminRoleDefinition = securityService.getOrCreateRoleDefinitionFromPrototype(AdminRole.getInstance(), /* makeReadableForAll */ true);
         final UserGroup adminTenant = securityService.getUserGroupByName(admin.getName()+SecurityService.TENANT_SUFFIX);
         securityService.createSimpleUser(username, "u@a.b", password, username, /* company */ null,
                 /* locale */ null, /* validationBaseURL */ null, /* owning group */ null);
         final UserGroup defaultUserGroup = securityService.getUserGroupByName(username + SecurityService.TENANT_SUFFIX);
         final QualifiedObjectIdentifier myId = my.getIdentifier();
         // grant admin role to user unqualified, implying READ on all objects including the "my" SERVER
-        securityService.addRoleForUser(username, new Role(securityService.getOrCreateRoleDefinitionFromPrototype(AdminRole.getInstance()), true));
+        securityService.addRoleForUser(username, new Role(adminRoleDefinition, true));
         securityService.login(username, password);
         securityService.setOwnership(myId, admin, adminTenant);
         // check explicit permission:
diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java b/java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java
index 7c263173f8b..010f7cb3467 100644
--- a/java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java
+++ b/java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java
@@ -629,7 +629,16 @@ public interface SecurityService extends ReplicableWithObjectInputStream<Replica
      */
     boolean isNewServer();
 
-    RoleDefinition getOrCreateRoleDefinitionFromPrototype(RolePrototype rolePrototype);
+    /**
+     * Tries to find a {@link RoleDefinition} whose ID equals that of the {@link RolePrototype} passed. If found, the
+     * permission set of the {@link RoleDefition} that was found is compared to that of the {@link RolePrototype}, and
+     * in case of differences the permission set of the {@link RolePrototype} is copied into the {@link RoleDefinition}.
+     * If no {@link RoleDefinition} by the ID specified by the {@link RolePrototype} is found, a new
+     * {@link RoleDefinition} is created. If {@code makeReadableForAll} is {@code true} and this server is just
+     * {@link #isInitialOrMigration() being initialized or migrating} then the new role definition will be made readable
+     * for all users by adding an ACL for the {@code null} group that grants the {@link DefaultActions#READ} permission.
+     */
+    RoleDefinition getOrCreateRoleDefinitionFromPrototype(RolePrototype rolePrototype, boolean makeReadableForAll);
 
     /** Sets the default ownership based on the current user. */
     void setDefaultOwnership(QualifiedObjectIdentifier identifier, String description);
diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java b/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java
index 546843818b5..2f493235606 100755
--- a/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java
+++ b/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java
@@ -2119,7 +2119,7 @@ implements ReplicableSecurityService, ClearStateTestSupport {
     }
 
     @Override
-    public RoleDefinition getOrCreateRoleDefinitionFromPrototype(final RolePrototype rolePrototype) {
+    public RoleDefinition getOrCreateRoleDefinitionFromPrototype(final RolePrototype rolePrototype, boolean makeReadableForAll) {
         final RoleDefinition potentiallyExistingRoleDefinition = store.getRoleDefinition(rolePrototype.getId());
         final RoleDefinition result;
         if (potentiallyExistingRoleDefinition == null) {
@@ -2135,6 +2135,10 @@ implements ReplicableSecurityService, ClearStateTestSupport {
         } else {
             result = potentiallyExistingRoleDefinition;
         }
+        if (makeReadableForAll && isInitialOrMigration()) {
+            // make role publicly readable
+            addToAccessControlList(result.getIdentifier(), /* for all users */ null, DefaultActions.READ.name());
+        }
         return result;
     }