diff --git a/.gitignore b/.gitignore
index a226853..777b2b7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -23,7 +23,7 @@ yarn-error.log*
 
 # Terraform
 .terraform/
-.terraform.lock.hcl
+# .terraform.lock.hcl est versionne (pas ignore) pour figer les versions de provider entre contributeurs/CI
 *.tfstate
 *.tfstate.*
 *.tfplan
diff --git a/infra/terraform/environments/dev/terraform.tfvars.example b/infra/terraform/environments/dev/terraform.tfvars.example
index ba86a56..323145a 100644
--- a/infra/terraform/environments/dev/terraform.tfvars.example
+++ b/infra/terraform/environments/dev/terraform.tfvars.example
@@ -2,6 +2,7 @@ ssh_host                = "10.0.0.10"
 ssh_port                = 22
 ssh_user                = "root"
 ssh_private_key_path    = "~/.ssh/id_ed25519_enervision"
-k3s_version             = ""
+# Epingler une version reelle avant apply : https://github.com/k3s-io/k3s/releases
+k3s_version             = "v1.31.5+k3s1"
 k3s_disable_components  = ["traefik"]
 kubeconfig_output_path  = "./kubeconfig"
diff --git a/infra/terraform/environments/dev/variables.tf b/infra/terraform/environments/dev/variables.tf
index b5f90db..9d507e3 100644
--- a/infra/terraform/environments/dev/variables.tf
+++ b/infra/terraform/environments/dev/variables.tf
@@ -23,8 +23,7 @@ variable "ssh_private_key_path" {
 
 variable "k3s_version" {
   type        = string
-  description = "Version k3s a installer. Chaine vide = derniere version stable."
-  default     = ""
+  description = "Version k3s a epingler pour un deploiement reproductible (ex: v1.31.5+k3s1). Voir https://github.com/k3s-io/k3s/releases."
 }
 
 variable "k3s_disable_components" {
diff --git a/infra/terraform/modules/k3s/main.tf b/infra/terraform/modules/k3s/main.tf
index 24be659..a8c23de 100644
--- a/infra/terraform/modules/k3s/main.tf
+++ b/infra/terraform/modules/k3s/main.tf
@@ -1,6 +1,6 @@
 locals {
   sudo_prefix    = var.ssh_user == "root" ? "" : "sudo "
-  install_env    = var.k3s_version != "" ? "INSTALL_K3S_VERSION=${var.k3s_version} " : ""
+  install_env    = "INSTALL_K3S_VERSION=${var.k3s_version} "
   disable_flags  = join(" ", [for c in var.k3s_disable_components : "--disable=${c}"])
   kubeconfig_cmd = "${local.sudo_prefix}cat /etc/rancher/k3s/k3s.yaml"
 }
@@ -22,10 +22,20 @@ resource "null_resource" "k3s_install" {
 
   provisioner "remote-exec" {
     inline = [
-      "${local.sudo_prefix}sh -c 'curl -sfL https://get.k3s.io | ${local.install_env}sh -s - server --write-kubeconfig-mode 644 ${local.disable_flags}'",
+      "${local.sudo_prefix}sh -c 'curl -sfL https://get.k3s.io | ${local.install_env}sh -s - server ${local.disable_flags}'",
       "until ${local.sudo_prefix}test -f /etc/rancher/k3s/k3s.yaml; do sleep 2; done",
     ]
   }
+
+  # Le kubeconfig est lu via sudo (fetch_kubeconfig), pas besoin de --write-kubeconfig-mode :
+  # il reste 600/root par defaut, ce qui evite d'exposer les droits cluster-admin a tout utilisateur local.
+  provisioner "remote-exec" {
+    when       = destroy
+    on_failure = continue
+    inline = [
+      "${local.sudo_prefix}sh -c 'test -x /usr/local/bin/k3s-uninstall.sh && /usr/local/bin/k3s-uninstall.sh || true'",
+    ]
+  }
 }
 
 resource "null_resource" "fetch_kubeconfig" {
diff --git a/infra/terraform/modules/k3s/variables.tf b/infra/terraform/modules/k3s/variables.tf
index 7f2f91d..08c0e1c 100644
--- a/infra/terraform/modules/k3s/variables.tf
+++ b/infra/terraform/modules/k3s/variables.tf
@@ -23,8 +23,12 @@ variable "ssh_private_key_path" {
 
 variable "k3s_version" {
   type        = string
-  description = "Version k3s a installer (ex: v1.31.2+k3s1). Chaine vide = derniere version stable."
-  default     = ""
+  description = "Version k3s a epingler pour un deploiement reproductible (ex: v1.31.5+k3s1). Voir https://github.com/k3s-io/k3s/releases."
+
+  validation {
+    condition     = length(trimspace(var.k3s_version)) > 0
+    error_message = "k3s_version doit etre epinglee explicitement, pas de valeur vide (sinon k3s.io installerait la derniere version a chaque run, non reproductible)."
+  }
 }
 
 variable "k3s_disable_components" {