diff --git a/.github/workflows/backend-build.yml b/.github/workflows/backend-build.yml
index 85f21a93..0374b9a1 100644
--- a/.github/workflows/backend-build.yml
+++ b/.github/workflows/backend-build.yml
@@ -20,7 +20,6 @@ jobs:
               uses: actions/setup-go@v5
               with:
                   go-version: "1.24.4"
-                  check-latest: true
                   cache-dependency-path: backend/gestion/go.sum
 
             - name: Download dependencies
@@ -69,7 +68,7 @@ jobs:
               uses: docker/build-push-action@v6
               with:
                   context: .
-                  file: docker-pre-prod/backend/Dockerfile
+                  file: docker-prod/backend/Dockerfile
                   target: runtime
                   push: true
                   tags: xor1234/backend-mln:${{ github.ref == 'refs/heads/main' && 'latest' || 'pre-prod' }}
@@ -79,18 +78,7 @@ jobs:
               uses: docker/build-push-action@v6
               with:
                   context: .
-                  file: docker-pre-prod/backend/Dockerfile
+                  file: docker-prod/backend/Dockerfile
                   target: waf
                   push: true
                   tags: xor1234/backend-mln:${{ github.ref == 'refs/heads/main' && 'waf' || 'waf-pre-prod' }}
-
-            - name: SSH Deploy
-              if: github.event_name == 'push'
-              uses: appleboy/ssh-action@v1
-              with:
-                  host: ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.SERVER_HOST_PROD || secrets.SERVER_HOST_PRE_PROD }}
-                  username: ${{ secrets.SERVER_USER }}
-                  key: ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.SERVER_SSH_KEY_PROD || secrets.SERVER_SSH_KEY_PRE_PROD }}
-                  script: |
-                      docker compose -f ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.COMPOSE_PATH_PROD || secrets.COMPOSE_PATH_PRE_PROD }} pull backend waf
-                      docker compose -f ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.COMPOSE_PATH_PROD || secrets.COMPOSE_PATH_PRE_PROD }} up -d --no-deps backend waf
diff --git a/.github/workflows/frontend-admin-build-local.yml b/.github/workflows/frontend-admin-build-local.yml
index 54ea06f2..1dfffeed 100644
--- a/.github/workflows/frontend-admin-build-local.yml
+++ b/.github/workflows/frontend-admin-build-local.yml
@@ -34,7 +34,16 @@ jobs:
 
             - name: Install EAS CLI & tooling
               run: |
-                  npm install -g eas-cli
+                  n=0
+                  until [ $n -ge 3 ]; do
+                    npm install -g eas-cli && break
+                    n=$((n + 1))
+                    echo "npm install -g eas-cli failed (attempt $n/3), cleaning up and retrying in 5s..."
+                    npm uninstall -g eas-cli >/dev/null 2>&1 || true
+                    rm -rf "$(npm root -g)/eas-cli" "$(npm root -g)"/.eas-cli-* 2>/dev/null || true
+                    sleep 5
+                  done
+                  command -v eas >/dev/null || { echo "::error::eas-cli installation failed after 3 attempts"; exit 1; }
                   pip install -r scripts/requirements.txt awscli --quiet
 
             - name: Install dependencies
@@ -52,12 +61,20 @@ jobs:
                     echo "profile=production"                                >> $GITHUB_OUTPUT
                     echo "channel=production-admin"                         >> $GITHUB_OUTPUT
                     echo "api_url=${{ secrets.PROD_API_URL }}"              >> $GITHUB_OUTPUT
+                    echo "ota_api_url=https://mln-uber.club"                >> $GITHUB_OUTPUT
+                    echo "xavia_url=https://ota-prod.uber-stup.club"        >> $GITHUB_OUTPUT
+                    echo "xavia_key=${{ secrets.XAVIA_KEY_ADMIN_PROD }}"    >> $GITHUB_OUTPUT
                     echo "apk_name=admin-panel-production-$(date +%Y%m%d-%H%M).apk" >> $GITHUB_OUTPUT
+                    echo "message=Production update $(date +%Y%m%d-%H%M)"  >> $GITHUB_OUTPUT
                   else
                     echo "profile=pre-prod"                                 >> $GITHUB_OUTPUT
                     echo "channel=pre-prod-admin"                           >> $GITHUB_OUTPUT
                     echo "api_url=${{ secrets.PREPROD_API_URL }}"           >> $GITHUB_OUTPUT
+                    echo "ota_api_url=https://5.181.0.112.nip.io"           >> $GITHUB_OUTPUT
+                    echo "xavia_url=https://ota-preprod.uber-stup.club"     >> $GITHUB_OUTPUT
+                    echo "xavia_key=${{ secrets.XAVIA_KEY_ADMIN_PREPROD }}" >> $GITHUB_OUTPUT
                     echo "apk_name=admin-panel-pre-prod-$(date +%Y%m%d-%H%M).apk" >> $GITHUB_OUTPUT
+                    echo "message=Pre-prod update $(date +%Y%m%d-%H%M)"    >> $GITHUB_OUTPUT
                   fi
 
             - name: Inject EAS project ID
@@ -66,6 +83,13 @@ jobs:
                   jq '.expo.extra.eas.projectId = "${{ secrets.EXPO_PROJECT_ID }}"' app.json > app.tmp.json
                   mv app.tmp.json app.json
 
+            - name: Select code signing certificate
+              working-directory: frontend-admin
+              run: |
+                  if [ "${{ steps.config.outputs.profile }}" = "pre-prod" ]; then
+                    cp certs/certificate-preprod.pem certs/certificate.pem
+                  fi
+
             - name: Restore Gradle cache (RustFS)
               env:
                   AWS_ACCESS_KEY_ID: ${{ secrets.RUSTFS_ACCESS_KEY }}
@@ -79,7 +103,7 @@ jobs:
               env:
                   EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
                   EXPO_PUBLIC_API_URL: ${{ steps.config.outputs.api_url }}
-                  EXPO_PUBLIC_UPDATE_URL: ${{ secrets.XAVIA_API_URL }}/api/manifest
+                  EXPO_PUBLIC_UPDATE_URL: ${{ steps.config.outputs.xavia_url }}
                   EAS_BUILD_NO_EXPO_GO_WARNING: true
                   NODE_OPTIONS: "--max-old-space-size=2048"
                   GRADLE_OPTS: "-Dorg.gradle.jvmargs=-Xmx3g -XX:MaxMetaspaceSize=512m -XX:+HeapDumpOnOutOfMemoryError -Dorg.gradle.daemon=false -Dorg.gradle.parallel=true -Dorg.gradle.workers.max=2"
@@ -113,20 +137,19 @@ jobs:
               working-directory: frontend-admin
               env:
                   EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
-                  EXPO_PUBLIC_API_URL: ${{ steps.config.outputs.api_url }}
-                  EXPO_PUBLIC_UPDATE_URL: ${{ secrets.XAVIA_API_URL }}/api/manifest
+                  EXPO_PUBLIC_API_URL: ${{ steps.config.outputs.ota_api_url }}
+                  EXPO_PUBLIC_UPDATE_URL: ${{ steps.config.outputs.xavia_url }}
                   NODE_OPTIONS: "--max-old-space-size=2048"
               run: |
                   RUNTIME_VERSION=$(jq -r '.expo.runtimeVersion' app.json)
-                  COMMIT_MESSAGE=$(git log -1 --pretty=%s ${{ github.sha }})
                   npx expo export --platform android --output-dir dist
-                  jq '.expo' app.json > dist/expoconfig.json
+                  npx expo config --json > dist/expoconfig.json
                   cd dist && zip -r ../bundle.zip . && cd ..
-                  curl -X POST "${{ secrets.XAVIA_API_URL }}/api/upload" \
-                    -F "uploadKey=${{ secrets.XAVIA_UPLOAD_KEY }}" \
+                  curl -X POST "${{ steps.config.outputs.xavia_url }}/api/upload" \
+                    -H "Authorization: Bearer ${{ steps.config.outputs.xavia_key }}" \
                     -F "file=@bundle.zip" \
                     -F "runtimeVersion=$RUNTIME_VERSION" \
                     -F "channel=${{ steps.config.outputs.channel }}" \
                     -F "commitHash=${{ github.sha }}" \
-                    -F "commitMessage=$COMMIT_MESSAGE" \
+                    -F "commitMessage=${{ steps.config.outputs.message }}" \
                     --fail
diff --git a/.github/workflows/frontend-client-build-local.yml b/.github/workflows/frontend-client-build-local.yml
index 7bb16126..8c00aed5 100644
--- a/.github/workflows/frontend-client-build-local.yml
+++ b/.github/workflows/frontend-client-build-local.yml
@@ -34,7 +34,16 @@ jobs:
 
             - name: Install EAS CLI & tooling
               run: |
-                  npm install -g eas-cli
+                  n=0
+                  until [ $n -ge 3 ]; do
+                    npm install -g eas-cli && break
+                    n=$((n + 1))
+                    echo "npm install -g eas-cli failed (attempt $n/3), cleaning up and retrying in 5s..."
+                    npm uninstall -g eas-cli >/dev/null 2>&1 || true
+                    rm -rf "$(npm root -g)/eas-cli" "$(npm root -g)"/.eas-cli-* 2>/dev/null || true
+                    sleep 5
+                  done
+                  command -v eas >/dev/null || { echo "::error::eas-cli installation failed after 3 attempts"; exit 1; }
                   pip install -r scripts/requirements.txt awscli --quiet
 
             - name: Install dependencies
@@ -52,12 +61,20 @@ jobs:
                     echo "profile=production"                                >> $GITHUB_OUTPUT
                     echo "channel=production-client"                        >> $GITHUB_OUTPUT
                     echo "api_url=${{ secrets.PROD_API_URL }}"              >> $GITHUB_OUTPUT
+                    echo "ota_api_url=${{ secrets.PROD_API_URL }}"          >> $GITHUB_OUTPUT
+                    echo "xavia_url=https://ota-mobile-prod.uber-stup.club" >> $GITHUB_OUTPUT
+                    echo "xavia_key=${{ secrets.XAVIA_KEY_MOBILE_PROD }}"   >> $GITHUB_OUTPUT
                     echo "apk_name=mobile-production-$(date +%Y%m%d-%H%M).apk" >> $GITHUB_OUTPUT
+                    echo "message=Production update $(date +%Y%m%d-%H%M)"  >> $GITHUB_OUTPUT
                   else
                     echo "profile=pre-prod"                                 >> $GITHUB_OUTPUT
                     echo "channel=pre-prod-client"                          >> $GITHUB_OUTPUT
                     echo "api_url=${{ secrets.PREPROD_API_URL }}"           >> $GITHUB_OUTPUT
+                    echo "ota_api_url=${{ secrets.PREPROD_API_URL }}"       >> $GITHUB_OUTPUT
+                    echo "xavia_url=https://ota-mobile-preprod.uber-stup.club" >> $GITHUB_OUTPUT
+                    echo "xavia_key=${{ secrets.XAVIA_KEY_MOBILE_PREPROD }}"   >> $GITHUB_OUTPUT
                     echo "apk_name=mobile-pre-prod-$(date +%Y%m%d-%H%M).apk" >> $GITHUB_OUTPUT
+                    echo "message=Pre-prod update $(date +%Y%m%d-%H%M)"    >> $GITHUB_OUTPUT
                   fi
 
             - name: Inject EAS project ID
@@ -66,6 +83,19 @@ jobs:
                   jq '.expo.extra.eas.projectId = "${{ secrets.EXPO_PROJECT_ID_CLIENT }}"' app.json > app.tmp.json
                   mv app.tmp.json app.json
 
+            - name: Select code signing certificate
+              # certs/certificate.pem (committé) correspond à la clé de signature
+              # du serveur OTA mobile de production ; le serveur pre-prod signe
+              # avec une clé différente (PRIVATE_KEY_MOBILE_PREPROD côté ota-uber),
+              # donc les builds pre-prod doivent embarquer
+              # certs/certificate-preprod.pem à la place, sous peine de voir toute
+              # MAJ OTA rejetée silencieusement (signature invalide) sur ce canal.
+              working-directory: mobile
+              run: |
+                  if [ "${{ steps.config.outputs.profile }}" = "pre-prod" ]; then
+                    cp certs/certificate-preprod.pem certs/certificate.pem
+                  fi
+
             - name: Restore Gradle cache (RustFS)
               env:
                   AWS_ACCESS_KEY_ID: ${{ secrets.RUSTFS_ACCESS_KEY }}
@@ -79,10 +109,10 @@ jobs:
               env:
                   EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
                   EXPO_PUBLIC_API_URL: ${{ steps.config.outputs.api_url }}
-                  EXPO_PUBLIC_UPDATE_URL: ${{ secrets.XAVIA_API_URL }}/api/manifest
+                  EXPO_PUBLIC_UPDATE_URL: ${{ steps.config.outputs.xavia_url }}
                   EAS_BUILD_NO_EXPO_GO_WARNING: true
                   NODE_OPTIONS: "--max-old-space-size=2048"
-                  GRADLE_OPTS: "-Dorg.gradle.jvmargs=-Xmx3g -XX:MaxMetaspaceSize=512m -XX:+HeapDumpOnOutOfMemoryError -Dorg.gradle.daemon=false -Dorg.gradle.parallel=true -Dorg.gradle.workers.max=2"
+                  GRADLE_OPTS: "-Dorg.gradle.jvmargs=-Xmx3g -XX:MaxMetaspaceSize=512m -XX:+HeapDumpOnOutOfMemoryError -Dorg.gradle.daemon=false -Dorg.gradle.parallel=true -Dorg.gradle.workers.max=2 -Dorg.gradle.internal.repository.max.retries=10 -Dorg.gradle.internal.repository.initial.backoff.ms=1000"
                   JAVA_TOOL_OPTIONS: "-Xmx3g"
               run: eas build --platform android --profile ${{ steps.config.outputs.profile }} --local --non-interactive
 
@@ -113,20 +143,19 @@ jobs:
               working-directory: mobile
               env:
                   EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
-                  EXPO_PUBLIC_API_URL: ${{ steps.config.outputs.api_url }}
-                  EXPO_PUBLIC_UPDATE_URL: ${{ secrets.XAVIA_API_URL }}/api/manifest
+                  EXPO_PUBLIC_API_URL: ${{ steps.config.outputs.ota_api_url }}
+                  EXPO_PUBLIC_UPDATE_URL: ${{ steps.config.outputs.xavia_url }}
                   NODE_OPTIONS: "--max-old-space-size=2048"
               run: |
                   RUNTIME_VERSION=$(jq -r '.expo.runtimeVersion' app.json)
-                  COMMIT_MESSAGE=$(git log -1 --pretty=%s ${{ github.sha }})
                   npx expo export --platform android --output-dir dist
-                  jq '.expo' app.json > dist/expoconfig.json
+                  npx expo config --json > dist/expoconfig.json
                   cd dist && zip -r ../bundle.zip . && cd ..
-                  curl -X POST "${{ secrets.XAVIA_API_URL }}/api/upload" \
-                    -F "uploadKey=${{ secrets.XAVIA_UPLOAD_KEY }}" \
+                  curl -X POST "${{ steps.config.outputs.xavia_url }}/api/upload" \
+                    -H "Authorization: Bearer ${{ steps.config.outputs.xavia_key }}" \
                     -F "file=@bundle.zip" \
                     -F "runtimeVersion=$RUNTIME_VERSION" \
                     -F "channel=${{ steps.config.outputs.channel }}" \
                     -F "commitHash=${{ github.sha }}" \
-                    -F "commitMessage=$COMMIT_MESSAGE" \
+                    -F "commitMessage=${{ steps.config.outputs.message }}" \
                     --fail
diff --git a/.github/workflows/frontend-web-build.yml b/.github/workflows/frontend-web-build.yml
index dcf92ee5..0d7cbaef 100644
--- a/.github/workflows/frontend-web-build.yml
+++ b/.github/workflows/frontend-web-build.yml
@@ -5,11 +5,12 @@ on:
         branches: [main, pre-prod]
         paths:
             - "frontend-prep/**"
-
+            - "docker-pre-prod/frontend/**"
     pull_request:
         branches: [main, pre-prod]
         paths:
             - "frontend-prep/**"
+            - "docker-pre-prod/frontend/**"
 
 jobs:
     build:
@@ -56,7 +57,7 @@ jobs:
               uses: docker/build-push-action@v6
               with:
                   context: .
-                  file: docker-pre-prod/frontend/Dockerfile
+                  file: docker-prod/frontend/Dockerfile
                   push: true
                   tags: xor1234/frontend-mln:${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && 'latest' || 'pre-prod' }}
                   build-args: |