diff --git a/.gitea/workflows/cicd.yml b/.gitea/workflows/cicd.yml
new file mode 100644
index 0000000..03af360
--- /dev/null
+++ b/.gitea/workflows/cicd.yml
@@ -0,0 +1,61 @@
+name: 'Terraform Apply'
+
+# CORRECTIF CI : l'apply ne se déclenche QUE sur un push (merge) vers main.
+# La validation et le plan des pull requests sont dans validate.yml.
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  apply:
+    name: 'Terraform Apply'
+    runs-on: ubuntu-latest
+    environment: production
+    defaults:
+      run:
+        shell: bash
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # 1.15.8 : les cores 1.7.x crashent (bug cty) avec le provider
+      # Cloudflare v5 récent et ses attributs dynamiques
+      - uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: 1.15.8
+
+      - name: Terraform Init
+        id: init
+        run: terraform init
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+
+      - name: Terraform Validate
+        id: validate
+        run: terraform validate
+
+      # NOTE : cloudflare_api_token n'est plus passé en -var : le provider
+      # Cloudflare lit le token depuis Vault (secret/cloudflare, clé api_token).
+      - name: Terraform Plan
+        id: plan
+        run: terraform plan -var="vault_token=${{ secrets.VAULT_TOKEN }}" -input=false -out=tfplan
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+
+      - name: Terraform Apply
+        run: terraform apply -input=false -auto-approve tfplan
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+
+      - name: Terraform Output
+        run: terraform output
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
diff --git a/.gitea/workflows/validate.yml b/.gitea/workflows/validate.yml
index 4c5e76b..3ae36e2 100644
--- a/.gitea/workflows/validate.yml
+++ b/.gitea/workflows/validate.yml
@@ -1,16 +1,20 @@
-name: 'Terraform Apply'
+name: 'Terraform Validate & Plan'
 
+# CORRECTIF CI : ce workflow ne fait plus QUE valider et planifier.
+# Il se déclenche sur les pull requests (et peut être lancé à la main).
+# L'apply est réservé au workflow cicd.yml, déclenché uniquement par un
+# push sur main. Avant : une simple PR ouverte déployait en production.
 on:
-  push:
-    branches: [ main ]
   pull_request:
     types: [opened, reopened, edited, synchronize]
+  workflow_dispatch:
+
 permissions:
   contents: read
 
 jobs:
   validate:
-    name: 'Terraform Apply'
+    name: 'Terraform Validate & Plan'
     runs-on: ubuntu-latest
     environment: production
     defaults:
@@ -21,9 +25,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      # 1.15.8 : les cores 1.7.x crashent (bug cty) avec le provider
+      # Cloudflare v5 récent et ses attributs dynamiques
       - uses: hashicorp/setup-terraform@v3
         with:
-          terraform_version: 1.7.5
+          terraform_version: 1.15.8
 
       - name: Terraform fmt
         id: fmt
@@ -41,27 +47,12 @@ jobs:
         id: validate
         run: terraform validate
 
+      # NOTE : cloudflare_api_token n'est plus passé en -var : le provider
+      # Cloudflare lit le token depuis Vault (secret/cloudflare, clé api_token).
+      # Seul le token Vault est nécessaire ici.
       - name: Terraform Plan
         id: plan
-        run: terraform plan -var="cloudflare_api_token=${{ secrets.CLOUDFLARE_API_TOKEN }}" -var="vault_token=${{ secrets.VAULT_TOKEN }}"
+        run: terraform plan -var="vault_token=${{ secrets.VAULT_TOKEN }}" -input=false
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-        
-      - name: Terraform Apply
-        run: terraform apply -var="cloudflare_api_token=${{ secrets.CLOUDFLARE_API_TOKEN }}" -var="vault_token=${{ secrets.VAULT_TOKEN }}" --auto-approve --input=false
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-
-#      - name: Terraform Destroy
-#        run: terraform destroy -var="cloudflare_api_token=${{ secrets.CLOUDFLARE_API_TOKEN }}" -var="vault_token=${{ secrets.VAULT_TOKEN }}" --auto-approve --input=false
-#        env:
-#          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-#          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-
-      - name: Terraform Output
-        run: terraform output
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
\ No newline at end of file