diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 8b6badf..495d59d 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -18,12 +18,104 @@ jobs:
           chmod 600 ~/.ssh/id_rsa
           ssh-keyscan -H 192.168.1.190 >> ~/.ssh/known_hosts
 
-      - name: Deploy via SSH
+      - name: Update .env.docker from Gitea vars & secrets
         env:
-          APP_URL: ${{ vars.APP_URL }}
-          ADMIN_EMAIL: ${{ vars.ADMIN_EMAIL }}
+          # ── Auth ──────────────────────────────────────────
+          APP_URL:             ${{ vars.APP_URL }}
+          NEXTAUTH_SECRET:     ${{ secrets.NEXTAUTH_SECRET }}
+          ADMIN_EMAIL:         ${{ vars.ADMIN_EMAIL }}
+          ALLOW_REGISTRATION:  ${{ vars.ALLOW_REGISTRATION }}
+          # ── Database ──────────────────────────────────────
+          POSTGRES_USER:       ${{ vars.POSTGRES_USER }}
+          POSTGRES_PASSWORD:   ${{ secrets.POSTGRES_PASSWORD }}
+          POSTGRES_DB:         ${{ vars.POSTGRES_DB }}
+          POSTGRES_PORT:       ${{ vars.POSTGRES_PORT }}
+          # ── AI Provider ───────────────────────────────────
+          AI_PROVIDER_TAGS:        ${{ vars.AI_PROVIDER_TAGS }}
+          AI_MODEL_TAGS:           ${{ vars.AI_MODEL_TAGS }}
+          AI_PROVIDER_EMBEDDING:   ${{ vars.AI_PROVIDER_EMBEDDING }}
+          AI_MODEL_EMBEDDING:      ${{ vars.AI_MODEL_EMBEDDING }}
+          AI_PROVIDER_CHAT:        ${{ vars.AI_PROVIDER_CHAT }}
+          AI_MODEL_CHAT:           ${{ vars.AI_MODEL_CHAT }}
+          CUSTOM_OPENAI_BASE_URL:  ${{ vars.CUSTOM_OPENAI_BASE_URL }}
+          CUSTOM_OPENAI_API_KEY:   ${{ secrets.CUSTOM_OPENAI_API_KEY }}
+          OPENAI_API_KEY:          ${{ secrets.OPENAI_API_KEY }}
+          OLLAMA_BASE_URL:         ${{ vars.OLLAMA_BASE_URL }}
+          # ── Email ─────────────────────────────────────────
+          EMAIL_PROVIDER:    ${{ vars.EMAIL_PROVIDER }}
+          SMTP_FROM:         ${{ vars.SMTP_FROM }}
+          RESEND_API_KEY:    ${{ secrets.RESEND_API_KEY }}
+          SMTP_HOST:         ${{ vars.SMTP_HOST }}
+          SMTP_PORT:         ${{ vars.SMTP_PORT }}
+          SMTP_USER:         ${{ vars.SMTP_USER }}
+          SMTP_PASS:         ${{ secrets.SMTP_PASS }}
+          SMTP_SECURE:       ${{ vars.SMTP_SECURE }}
+          SMTP_IGNORE_CERT:  ${{ vars.SMTP_IGNORE_CERT }}
+          # ── MCP ───────────────────────────────────────────
+          MCP_MODE:  ${{ vars.MCP_MODE }}
+          MCP_PORT:  ${{ vars.MCP_PORT }}
+          # ── Tools ─────────────────────────────────────────
+          WEB_SEARCH_PROVIDER:  ${{ vars.WEB_SEARCH_PROVIDER }}
+          SEARXNG_URL:          ${{ vars.SEARXNG_URL }}
+          BRAVE_SEARCH_API_KEY: ${{ secrets.BRAVE_SEARCH_API_KEY }}
+          JINA_API_KEY:         ${{ secrets.JINA_API_KEY }}
         run: |
-          ssh root@192.168.1.190 bash << ENDSSH
+          ssh root@192.168.1.190 bash << 'ENDSSH'
+            ENV_FILE="/opt/memento/.env.docker"
+            # Crée le fichier s'il n'existe pas
+            touch "$ENV_FILE"
+
+            # Fonction : met à jour ou ajoute une variable si la valeur est non-vide
+            upsert() {
+              local key="$1" val="$2"
+              [ -z "$val" ] && return
+              if grep -q "^${key}=" "$ENV_FILE" 2>/dev/null; then
+                sed -i "s|^${key}=.*|${key}=\"${val}\"|" "$ENV_FILE"
+              else
+                echo "${key}=\"${val}\"" >> "$ENV_FILE"
+              fi
+            }
+
+            upsert NEXTAUTH_URL           "$APP_URL"
+            upsert NEXTAUTH_SECRET        "$NEXTAUTH_SECRET"
+            upsert ADMIN_EMAIL            "$ADMIN_EMAIL"
+            upsert ALLOW_REGISTRATION     "$ALLOW_REGISTRATION"
+            upsert POSTGRES_USER          "$POSTGRES_USER"
+            upsert POSTGRES_PASSWORD      "$POSTGRES_PASSWORD"
+            upsert POSTGRES_DB            "$POSTGRES_DB"
+            upsert POSTGRES_PORT          "$POSTGRES_PORT"
+            upsert AI_PROVIDER_TAGS       "$AI_PROVIDER_TAGS"
+            upsert AI_MODEL_TAGS          "$AI_MODEL_TAGS"
+            upsert AI_PROVIDER_EMBEDDING  "$AI_PROVIDER_EMBEDDING"
+            upsert AI_MODEL_EMBEDDING     "$AI_MODEL_EMBEDDING"
+            upsert AI_PROVIDER_CHAT       "$AI_PROVIDER_CHAT"
+            upsert AI_MODEL_CHAT          "$AI_MODEL_CHAT"
+            upsert CUSTOM_OPENAI_BASE_URL "$CUSTOM_OPENAI_BASE_URL"
+            upsert CUSTOM_OPENAI_API_KEY  "$CUSTOM_OPENAI_API_KEY"
+            upsert OPENAI_API_KEY         "$OPENAI_API_KEY"
+            upsert OLLAMA_BASE_URL        "$OLLAMA_BASE_URL"
+            upsert EMAIL_PROVIDER         "$EMAIL_PROVIDER"
+            upsert SMTP_FROM              "$SMTP_FROM"
+            upsert RESEND_API_KEY         "$RESEND_API_KEY"
+            upsert SMTP_HOST              "$SMTP_HOST"
+            upsert SMTP_PORT              "$SMTP_PORT"
+            upsert SMTP_USER              "$SMTP_USER"
+            upsert SMTP_PASS              "$SMTP_PASS"
+            upsert SMTP_SECURE            "$SMTP_SECURE"
+            upsert SMTP_IGNORE_CERT       "$SMTP_IGNORE_CERT"
+            upsert MCP_MODE               "$MCP_MODE"
+            upsert MCP_PORT               "$MCP_PORT"
+            upsert WEB_SEARCH_PROVIDER    "$WEB_SEARCH_PROVIDER"
+            upsert SEARXNG_URL            "$SEARXNG_URL"
+            upsert BRAVE_SEARCH_API_KEY   "$BRAVE_SEARCH_API_KEY"
+            upsert JINA_API_KEY           "$JINA_API_KEY"
+
+            echo ".env.docker updated"
+          ENVSSH
+
+      - name: Deploy via SSH
+        run: |
+          ssh root@192.168.1.190 << 'ENDSSH'
             set -e
             cd /opt/memento
 
@@ -31,27 +123,6 @@ jobs:
             git config --global --add safe.directory /opt/memento
             git pull origin main
 
-            echo "=== Update config from Gitea vars ==="
-            ENV_FILE="/opt/memento/.env.docker"
-
-            if [ -n "$APP_URL" ]; then
-              if grep -q "^NEXTAUTH_URL=" "\$ENV_FILE"; then
-                sed -i "s|^NEXTAUTH_URL=.*|NEXTAUTH_URL=\"$APP_URL\"|" "\$ENV_FILE"
-              else
-                echo "NEXTAUTH_URL=\"$APP_URL\"" >> "\$ENV_FILE"
-              fi
-              echo "  NEXTAUTH_URL => $APP_URL"
-            fi
-
-            if [ -n "$ADMIN_EMAIL" ]; then
-              if grep -q "^ADMIN_EMAIL=" "\$ENV_FILE"; then
-                sed -i "s|^ADMIN_EMAIL=.*|ADMIN_EMAIL=\"$ADMIN_EMAIL\"|" "\$ENV_FILE"
-              else
-                echo "ADMIN_EMAIL=\"$ADMIN_EMAIL\"" >> "\$ENV_FILE"
-              fi
-              echo "  ADMIN_EMAIL => $ADMIN_EMAIL"
-            fi
-
             echo "=== Building ==="
             docker compose build memento-note