diff --git a/docker-compose.kc26.yml b/docker-compose.kc26.yml
new file mode 100644
index 0000000..6e8679d
--- /dev/null
+++ b/docker-compose.kc26.yml
@@ -0,0 +1,73 @@
+version: '3.8'
+
+# Compose alternatif Keycloak 26.6.1 avec feature Organizations native (GA depuis 26.0).
+# Usage : docker compose -f docker-compose.kc26.yml up -d
+# But : valider la migration KC23 → KC26 + Organizations en local, sans toucher au compose dev.
+#
+# Une fois la migration validée, basculer ce contenu en production et supprimer la stack KC23.
+#
+# Réf : ARCH_KEYCLOAK_26.md
+
+services:
+  postgres-keycloak:
+    image: postgres:15-alpine
+    container_name: kc26-postgres
+    environment:
+      POSTGRES_DB: keycloak
+      POSTGRES_USER: keycloak
+      POSTGRES_PASSWORD: keycloak
+      POSTGRES_INITDB_ARGS: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
+    volumes:
+      - kc26_postgres_data:/var/lib/postgresql/data
+    networks:
+      - kc26-net
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U keycloak -d keycloak"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+
+  keycloak:
+    image: quay.io/keycloak/keycloak:26.6.1
+    container_name: kc26-server
+    command:
+      - start-dev
+      - --features=organization
+      - --http-port=8180
+      - --import-realm
+    environment:
+      KC_BOOTSTRAP_ADMIN_USERNAME: admin
+      KC_BOOTSTRAP_ADMIN_PASSWORD: admin
+      KC_DB: postgres
+      KC_DB_URL: jdbc:postgresql://postgres-keycloak:5432/keycloak
+      KC_DB_USERNAME: keycloak
+      KC_DB_PASSWORD: keycloak
+      KC_HEALTH_ENABLED: "true"
+      KC_METRICS_ENABLED: "true"
+      KC_HOSTNAME_STRICT: "false"
+      KC_HTTP_ENABLED: "true"
+    ports:
+      - "8180:8180"
+    volumes:
+      - ./src/main/resources/keycloak/realms:/opt/keycloak/data/import:ro
+    depends_on:
+      postgres-keycloak:
+        condition: service_healthy
+    networks:
+      - kc26-net
+    healthcheck:
+      test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/8180 && echo -e 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && cat <&3 | grep -q 'UP'"]
+      interval: 15s
+      timeout: 5s
+      retries: 8
+      start_period: 60s
+    restart: unless-stopped
+
+volumes:
+  kc26_postgres_data:
+    driver: local
+
+networks:
+  kc26-net:
+    driver: bridge
diff --git a/src/test/java/dev/lions/unionflow/server/service/KeycloakAdminHttpClientTest.java b/src/test/java/dev/lions/unionflow/server/service/KeycloakAdminHttpClientTest.java
index 5c41e44..49aef90 100644
--- a/src/test/java/dev/lions/unionflow/server/service/KeycloakAdminHttpClientTest.java
+++ b/src/test/java/dev/lions/unionflow/server/service/KeycloakAdminHttpClientTest.java
@@ -40,7 +40,8 @@ class KeycloakAdminHttpClientTest {
     private HttpResponse<String> mockResponse(int statusCode, String body) {
         HttpResponse<String> resp = mock(HttpResponse.class);
         when(resp.statusCode()).thenReturn(statusCode);
-        when(resp.body()).thenReturn(body);
+        // body() is only read on error paths or when parsing JSON — make lenient
+        lenient().when(resp.body()).thenReturn(body);
         return resp;
     }