diff --git a/.gitea/workflows/iac.yaml b/.gitea/workflows/iac.yaml
index bf09ea5..7fbc0e4 100644
--- a/.gitea/workflows/iac.yaml
+++ b/.gitea/workflows/iac.yaml
@@ -3,7 +3,13 @@
 name: IAC
 
 on: #[push,pull_request]
-  workflow_dispatch: {}
+  workflow_dispatch:
+    inputs:
+      mode:
+        description: "plan : montrer ce qui changerait, sans rien appliquer ; apply : appliquer"
+        type: choice
+        options: [apply, plan]
+        default: apply
   push: &tofuPaths
     paths:
       - 'iac/*.tf'
@@ -60,12 +66,30 @@ jobs:
       - uses: actions/checkout@v4
       - name: prepare vault self signed cert
         run: echo -n "${{ secrets.HOMELAB_CA_CERT }}" | base64 -d > $VAULT_CACERT
-      - name: terraform apply
-        uses: dflook/terraform-apply@v1
-        env:
-          # the apply runs in dflook's container, which doesn't trust the homelab CA;
-          # hand the gitea provider the CA cert the step above wrote to the workspace
-          TF_VAR_gitea_cacert_file: "${{ github.workspace }}/homelab.pem"
+      # ⚠ PLUS DE `dflook/terraform-apply` (2026-10-08) : c'est une action CONTENEUR, et
+      # depuis 93e7abf (2026-08-26) les conteneurs de job reçoivent `--add-host` (résolution
+      # figée de la forge, 03_cicd.yml). Docker refuse alors de lancer le conteneur de
+      # l'action dans le réseau du job : « conflicting options: custom host-to-IP mapping
+      # and the network mode » — le dernier apply réussi datait du 2026-07-24 (pi1).
+      # OpenTofu tourne donc DANS le conteneur du job (ubuntu-latest-ca, qui connaît la CA
+      # du homelab), installé par une action JavaScript.
+      - name: install OpenTofu
+        uses: opentofu/setup-opentofu@v1
         with:
-          path: iac
-          auto_approve: true
\ No newline at end of file
+          tofu_version: ${{ env.OPENTOFU_VERSION }}
+          tofu_wrapper: false
+      - name: tofu init
+        working-directory: iac
+        run: tofu init -input=false
+      - name: tofu plan
+        working-directory: iac
+        env:
+          TF_VAR_gitea_cacert_file: "${{ github.workspace }}/homelab.pem"
+        run: tofu plan -input=false -out=plan.tfplan
+      # Un `push` (sans entrée) applique, comme avant ; un dispatch en `plan` s'arrête ici.
+      - name: tofu apply
+        if: ${{ github.event_name != 'workflow_dispatch' || inputs.mode != 'plan' }}
+        working-directory: iac
+        env:
+          TF_VAR_gitea_cacert_file: "${{ github.workspace }}/homelab.pem"
+        run: tofu apply -input=false plan.tfplan
diff --git a/iac/cloudflare.tf b/iac/cloudflare.tf
index a879fc4..13d52fa 100644
--- a/iac/cloudflare.tf
+++ b/iac/cloudflare.tf
@@ -72,6 +72,11 @@ module "cf_arcodange_cms_token" {
       "zone:DNS Write",
       "account:Cloudflare Tunnel Write",
       "account:Turnstile Sites Write",
+      # 2026-10-08 — la règle `forge_registre_ferme` (cms/cloudflare/waf.tf) : un
+      # `cloudflare_ruleset` de phase `http_request_firewall_custom` sur la zone.
+      # Gratuit (5 règles personnalisées au forfait Free). ⚠ Changer un nom ici
+      # REMPLACE le jeton (replace_triggered_by) : le secret Gitea de cms et Vault suivent.
+      "zone:Zone WAF Write",
     ]
   }
 }