diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml
index ea9a44c..a1fd762 100644
--- a/.forgejo/workflows/deploy.yml
+++ b/.forgejo/workflows/deploy.yml
@@ -23,6 +23,9 @@ jobs:
             cd /opt/projects/info-canicule
             git fetch --prune origin main
             git reset --hard origin/main
+            # Auto-répare la session pass-cli expirée avant de rendre le .env,
+            # sinon « Your session has been invalidated » (cf. infra scripts/ensure-pass-session.sh).
+            [ -x /opt/infra/scripts/ensure-pass-session.sh ] && /opt/infra/scripts/ensure-pass-session.sh || true
             make env
             docker compose up -d --build --wait
             docker image prune -f