diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 5ca3916..658ccae 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -1,58 +1,78 @@
-name: CI/CD Lions Pipeline
+# ============================================================================
+# Template — .gitea/workflows/ci.yml
+# Drop this file into each app repo (adjust LIONS_JAVA_VERSION +
+# LIONS_APP_NAME + optional --deploy-repo-url). It runs inside the
+# registry.lions.dev/lionsdev/lionsctl-ci:latest image, so lionsctl,
+# kubectl, helm, docker CLI, JDK 17+21 and Maven are all pre-installed.
+#
+# Required Gitea repo secrets:
+#   LIONS_REGISTRY_USERNAME   (typically "lionsregistry")
+#   LIONS_REGISTRY_PASSWORD
+#   LIONS_GIT_USERNAME        (typically "lionsdev")
+#   LIONS_GIT_ACCESS_TOKEN    (Gitea PAT with write:repository, write:package)
+#   LIONS_GIT_PASSWORD        (Gitea password for same user — Helm mode)
+#   SMTP_HOST SMTP_PORT SMTP_USERNAME SMTP_PASSWORD SMTP_FROM
+# ============================================================================
+name: CI/CD Pipeline
 
 on:
   push:
-    branches: [main, develop]
-  workflow_dispatch:
-    inputs:
-      environment:
-        description: 'Environnement cible'
-        required: true
-        default: 'production'
-        type: choice
-        options:
-          - dev
-          - staging
-          - production
+    branches: [ main ]
+  workflow_dispatch: {}
 
 env:
-  LIONS_CLUSTER: k1
-  LIONS_JAVA_VERSION: '17'   # override si app en Java 21
+  # Adjust per repo:
+  #   - unionflow-server-impl-quarkus      -> 21
+  #   - all others                         -> 17
+  LIONS_JAVA_VERSION: "17"
+  LIONS_CLUSTER: "k1"
 
 jobs:
   pipeline:
-    name: Build + Push + Deploy
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    container:
+      image: registry.lions.dev/lionsdev/lionsctl-ci:latest
+      credentials:
+        username: ${{ secrets.LIONS_REGISTRY_USERNAME }}
+        password: ${{ secrets.LIONS_REGISTRY_PASSWORD }}
+      # Mount the host docker socket so `docker build/push` inside the
+      # container hits the runner's daemon (DinD-free).
+      volumes:
+        - /var/run/docker.sock:/var/run/docker.sock
 
     steps:
-      - name: Checkout code
+      - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Setup lionsctl
+      - name: Show tooling
         run: |
-          # Suppose lionsctl installé sur le runner (via image custom)
-          # Alternative : curl -L https://git.lions.dev/lionsdev/lionsctl/releases/download/latest/lionsctl -o /usr/local/bin/lionsctl
-          lionsctl --version
+          lionsctl --version || true
+          docker --version
+          kubectl version --client=true
+          helm version --short
+          mvn --version | head -n2
 
       - name: Pipeline deploy
         env:
           LIONS_REGISTRY_USERNAME: ${{ secrets.LIONS_REGISTRY_USERNAME }}
           LIONS_REGISTRY_PASSWORD: ${{ secrets.LIONS_REGISTRY_PASSWORD }}
-          LIONS_GIT_USERNAME: lionsctl-bot
-          LIONS_GIT_PASSWORD: ${{ secrets.LIONS_GIT_PASSWORD }}
-          LIONS_GIT_ACCESS_TOKEN: ${{ secrets.LIONS_GIT_ACCESS_TOKEN }}
-          SMTP_HOST: ${{ secrets.SMTP_HOST }}
-          SMTP_USERNAME: ${{ secrets.SMTP_USERNAME }}
-          SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
-          SMTP_FROM: ${{ secrets.SMTP_FROM }}
+          LIONS_GIT_USERNAME:      ${{ secrets.LIONS_GIT_USERNAME }}
+          LIONS_GIT_ACCESS_TOKEN:  ${{ secrets.LIONS_GIT_ACCESS_TOKEN }}
+          LIONS_GIT_PASSWORD:      ${{ secrets.LIONS_GIT_PASSWORD }}
+          SMTP_HOST:               ${{ secrets.SMTP_HOST }}
+          SMTP_PORT:               ${{ secrets.SMTP_PORT }}
+          SMTP_USERNAME:           ${{ secrets.SMTP_USERNAME }}
+          SMTP_PASSWORD:           ${{ secrets.SMTP_PASSWORD }}
+          SMTP_FROM:               ${{ secrets.SMTP_FROM }}
         run: |
-          ENV="${{ github.event.inputs.environment || 'production' }}"
+          # For btpxpress-backend add:  --deploy-repo-url https://git.lions.dev/lionsdev/btpxpress-server-k1
+          # For btpxpress-frontend add: --deploy-repo-url https://git.lions.dev/lionsdev/btpxpress-client-k1
           lionsctl pipeline \
             -u ${{ gitea.server_url }}/${{ gitea.repository }} \
             -b ${{ gitea.ref_name }} \
             -j ${{ env.LIONS_JAVA_VERSION }} \
-            -e "$ENV" \
+            -e production \
             -c ${{ env.LIONS_CLUSTER }} \
             -p prod \
-            -m admin@lions.dev
+            --deploy-repo-url https://git.lions.dev/lionsdev/lions-user-manager-server-impl-quarkus-k1 \
+            -m admin@lions.dev
\ No newline at end of file