diff --git a/scripts/list_users.php b/scripts/list_users.php
index 1b58cd2..63e2815 100644
--- a/scripts/list_users.php
+++ b/scripts/list_users.php
@@ -8,5 +8,7 @@ $users = $db->query("SELECT id, email, name FROM users")->fetchAll();
 echo "ID | Email | Name\n";
 echo "----------------------\n";
 foreach ($users as $user) {
-    echo "{$user['id']} | {$user['email']} | {$user['name']}\n";
+    $email = App\Core\Encryption::decrypt($user['email']) ?: $user['email'];
+    $name = App\Core\Encryption::decrypt($user['name']) ?: $user['name'];
+    echo "{$user['id']} | $email | $name\n";
 }
diff --git a/scripts/update_phone.php b/scripts/update_phone.php
index 73a1afc..8704ab8 100644
--- a/scripts/update_phone.php
+++ b/scripts/update_phone.php
@@ -10,12 +10,13 @@ use App\Core\Database;
 use App\Core\Encryption;
 
 // Parse CLI arguments
-$options = getopt("", ["email:", "phone:"]);
+$options = getopt("", ["email:", "phone:", "id:"]);
 $email = $options['email'] ?? null;
 $phone = $options['phone'] ?? null;
+$id = $options['id'] ?? null;
 
-if (!$email || !$phone) {
-    die("Usage: php scripts/update_phone.php --email=your@email.com --phone=yourphone\n");
+if ((!$email && !$id) || !$phone) {
+    die("Usage: php scripts/update_phone.php --phone=yourphone [--email=your@email.com | --id=user-uuid]\n");
 }
 
 $db = Database::getInstance();
@@ -26,11 +27,19 @@ $phoneHash = hash('sha256', $cleanPhone);
 $encryptedPhone = Encryption::encrypt($cleanPhone);
 
 // 2. Update user
-$stmt = $db->prepare("UPDATE users SET phone = ?, phone_hash = ? WHERE email = ?");
-$stmt->execute([$encryptedPhone, $phoneHash, $email]);
+if ($id) {
+    $stmt = $db->prepare("UPDATE users SET phone = ?, phone_hash = ? WHERE id = ?");
+    $stmt->execute([$encryptedPhone, $phoneHash, $id]);
+    $identifier = "ID $id";
+} else {
+    // Note: Searching by encrypted email will likely fail due to IV randomness. Use ID.
+    $stmt = $db->prepare("UPDATE users SET phone = ?, phone_hash = ? WHERE email = ?");
+    $stmt->execute([$encryptedPhone, $phoneHash, $email]);
+    $identifier = "email $email";
+}
 
 if ($stmt->rowCount() > 0) {
-    echo "✅ Success! Phone updated for $email\n";
+    echo "✅ Success! Phone updated for $identifier\n";
     echo "   Encrypted: $encryptedPhone\n";
     echo "   Hash: $phoneHash\n";
 } else {