diff --git a/scripts/build_and_push.sh b/scripts/build_and_push.sh
index 69acf50..ecc5fae 100644
--- a/scripts/build_and_push.sh
+++ b/scripts/build_and_push.sh
@@ -13,6 +13,10 @@ if [ -z "${DOCKER_TAG:-}" ]; then
   exit 1
 fi
 
+# Normalisation du tag pour Docker (sécurité côté script)
+DOCKER_TAG=${DOCKER_TAG##*/}
+DOCKER_TAG=$(printf "%s" "$DOCKER_TAG" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9_.-]/-/g')
+
 echo "[docker] registry=${REGISTRY} namespace=${NAMESPACE} tag=${DOCKER_TAG}"
 
 if ! command -v docker >/dev/null 2>&1; then