diff --git a/deploy/deploy-by-script-to.sh b/deploy/deploy-by-script-to.sh
index e12512d..c7d76e1 100755
--- a/deploy/deploy-by-script-to.sh
+++ b/deploy/deploy-by-script-to.sh
@@ -21,6 +21,13 @@ PROJECT_ROOT="${IA_PROJECT_GIT_ROOT:-}"
 if [[ -z "$PROJECT_ROOT" || ! -d "$PROJECT_ROOT" ]]; then
 	PROJECT_ROOT="$(cd "$DEPLOY_IA/../.." && pwd)"
 fi
+if [[ -n "${PROJECT_CONFIG_PATH:-}" && -f "${PROJECT_CONFIG_PATH:-}" ]] && command -v jq >/dev/null 2>&1; then
+	_sp="$(jq -r '.deploy.secrets_path // empty' "$PROJECT_CONFIG_PATH" 2>/dev/null)"
+	if [[ -n "$_sp" && "$_sp" != "null" && -d "$_sp" ]]; then
+		export SECRETS_BASE="$_sp"
+		export LECOFFRE_SECRETS_BASE="$_sp"
+	fi
+fi
 if [[ "$(pwd)" != "$PROJECT_ROOT" ]]; then
 	# Preserve project id for re-exec so config is still resolved in child
 	[[ -n "${PROJECT_ID:-}" ]] && export IA_PROJECT_ID="$PROJECT_ID"
@@ -54,12 +61,13 @@ if [[ "$(git rev-parse --abbrev-ref HEAD)" != "$TARGET_BRANCH" ]]; then
 	git checkout "$TARGET_BRANCH"
 fi
 
-SECRETS_DIR="${PROJECT_ROOT}/.secrets/${TARGET_BRANCH}"
+SECRETS_PARENT="${SECRETS_BASE:-${LECOFFRE_SECRETS_BASE:-$PROJECT_ROOT/.secrets}}"
+SECRETS_DIR="${SECRETS_PARENT}/${TARGET_BRANCH}"
 if [[ ! -d "$SECRETS_DIR" ]]; then
-	echo "[deploy-by-script-to][ERROR] .secrets/${TARGET_BRANCH} does not exist at ${SECRETS_DIR}" >&2
+	echo "[deploy-by-script-to][ERROR] secrets env dir missing: ${SECRETS_DIR} (set SECRETS_BASE or deploy.secrets_path in conf)" >&2
 	exit 1
 fi
-echo "[deploy-by-script-to] Step 2/5: .secrets/${TARGET_BRANCH} OK"
+echo "[deploy-by-script-to] Step 2/5: secrets/${TARGET_BRANCH} OK (${SECRETS_DIR})"
 
 echo "[deploy-by-script-to] Step 3/5: force sync local branch with origin/${TARGET_BRANCH}..."
 git fetch origin
diff --git a/deploy/lib/README.md b/deploy/lib/README.md
index 9542a2b..b384671 100644
--- a/deploy/lib/README.md
+++ b/deploy/lib/README.md
@@ -1,7 +1,14 @@
-# Shared deploy helpers (ia_dev)
+# Shared deploy libraries (ia_dev)
 
-LeCoffre conserve la logique métier et SSH ciblée dans `lecoffre_ng_test/deploy/scripts_v2/` (dont `_lib/` : `ssh.sh`, `colors.sh`, modules `deploy-*.sh`).
+## `ssh.sh`
 
-Ce répertoire est réservé aux **extraits réellement génériques** (plusieurs projets, sans Prisma ni règles LeCoffre), extraits **après** stabilisation de la segmentation côté projet. Aujourd’hui les helpers SSH/proxy dupliqués ne sont pas déplacés ici pour éviter une double source de vérité avant revue transverse.
+Canonical SSH/SCP helpers (`ssh_run`, `scp_copy`, `require_ssh_key`, `ssh_common_opts`) used across projects.  
+**LeCoffre** : `deploy/scripts_v2/_lib/ssh.sh` sources `ia_dev/deploy/lib/ssh.sh` when the submodule path `ia_dev/deploy/lib/ssh.sh` exists from the repo root; otherwise it embeds the same implementation.
 
-Référence cadrage : dépôt LeCoffre, `deploy/DEPLOY_ORCHESTRATION_IA_DEV.md`.
+## `deploy-log.sh`
+
+Optional `deploy_script_tee_log_if_requested <project_root> <log_subdir>` — requires `info` from the project’s `colors.sh` (sourced before this file in `deploy.sh`).
+
+## Policy
+
+Project-specific logic (Prisma, systemd unit names, remote app layout, LeCoffre domains) stays under each repository’s `deploy/scripts_v2/`. Only transport/logging helpers live here.
diff --git a/deploy/lib/deploy-log.sh b/deploy/lib/deploy-log.sh
new file mode 100644
index 0000000..8a79399
--- /dev/null
+++ b/deploy/lib/deploy-log.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Optional tee of deploy output to a log file under the project root.
+
+# Args: project_root log_to_dir_relative (empty = skip)
+deploy_script_tee_log_if_requested() {
+	local project_root="${1:?}"
+	local log_to_dir="${2:-}"
+	if [[ -z "$log_to_dir" ]]; then
+		return 0
+	fi
+	mkdir -p "${project_root}/${log_to_dir}"
+	local log_file
+	log_file="${project_root}/${log_to_dir}/deploy_$(date +%Y%m%d_%H%M%S).log"
+	info "[deploy] Teeing output to ${log_file}"
+	exec > >(tee "$log_file")
+}
diff --git a/deploy/lib/ssh.sh b/deploy/lib/ssh.sh
new file mode 100644
index 0000000..f13b3fa
--- /dev/null
+++ b/deploy/lib/ssh.sh
@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+# Shared SSH/SCP helpers for deploy scripts (ProxyJump, BatchMode, keepalive).
+# Sourced by project deploy/_lib/ssh.sh when ia_dev is present as submodule/sibling.
+
+set -euo pipefail
+
+require_ssh_key() {
+	local key_path="$1"
+	if [[ -z "$key_path" ]]; then
+		echo "SSH key path is required" >&2
+		return 1
+	fi
+	if [[ ! -f "$key_path" ]]; then
+		echo "SSH key not found: $key_path" >&2
+		return 1
+	fi
+}
+
+ssh_common_opts() {
+	local ssh_user="$1"
+	local ssh_host="$2"
+
+	echo \
+		-o BatchMode=yes \
+		-o StrictHostKeyChecking=accept-new \
+		-o ConnectTimeout=30 \
+		-o ServerAliveInterval=10 \
+		-o ServerAliveCountMax=6 \
+		-o TCPKeepAlive=yes \
+		-o Compression=no
+}
+
+ssh_run() {
+	local ssh_key="$1"
+	local ssh_user="$2"
+	local ssh_host="$3"
+	shift 3
+
+	require_ssh_key "$ssh_key"
+
+	local proxy_host="${DEPLOY_SSH_PROXY_HOST:-}"
+	local proxy_user="${DEPLOY_SSH_PROXY_USER:-$ssh_user}"
+
+	local proxy_args=()
+	if [[ -n "$proxy_host" ]]; then
+		proxy_args=(-J "$proxy_user@$proxy_host")
+	fi
+
+	# shellcheck disable=SC2207
+	local common_opts=($(ssh_common_opts "$ssh_user" "$ssh_host"))
+
+	ssh -i "$ssh_key" \
+		"${common_opts[@]}" \
+		"${proxy_args[@]}" \
+		"$ssh_user@$ssh_host" "$@"
+}
+
+scp_copy() {
+	local ssh_key="$1"
+	local src="$2"
+	local ssh_user="$3"
+	local ssh_host="$4"
+	local dst="$5"
+	local recursive="${6:-false}"
+
+	require_ssh_key "$ssh_key"
+
+	local proxy_host="${DEPLOY_SSH_PROXY_HOST:-}"
+	local proxy_user="${DEPLOY_SSH_PROXY_USER:-$ssh_user}"
+
+	local proxy_args=()
+	if [[ -n "$proxy_host" ]]; then
+		proxy_args=(-o "ProxyJump=$proxy_user@$proxy_host")
+	fi
+
+	# shellcheck disable=SC2207
+	local common_opts=($(ssh_common_opts "$ssh_user" "$ssh_host"))
+
+	local scp_opts=()
+	if [[ "$recursive" == "true" ]] || [[ -d "$src" ]]; then
+		scp_opts=(-r)
+	fi
+
+	scp -i "$ssh_key" \
+		"${scp_opts[@]}" \
+		"${common_opts[@]}" \
+		"${proxy_args[@]}" \
+		"$src" "$ssh_user@$ssh_host:$dst"
+}
diff --git a/deploy/run-project-hooks.sh b/deploy/run-project-hooks.sh
index 8b5bfaa..7eff94c 100755
--- a/deploy/run-project-hooks.sh
+++ b/deploy/run-project-hooks.sh
@@ -36,6 +36,12 @@ if ! command -v jq >/dev/null 2>&1; then
 	exit 1
 fi
 
+SECRETS_PATH_CFG="$(jq -r '.deploy.secrets_path // empty' "$CONF")"
+if [[ -n "$SECRETS_PATH_CFG" && "$SECRETS_PATH_CFG" != "null" && -d "$SECRETS_PATH_CFG" ]]; then
+	export SECRETS_BASE="$SECRETS_PATH_CFG"
+	export LECOFFRE_SECRETS_BASE="$SECRETS_PATH_CFG"
+fi
+
 DEPLOY_SCRIPT_PATH="$(jq -r '.deploy.deploy_script_path // empty' "$CONF")"
 if [[ -z "$DEPLOY_SCRIPT_PATH" || ! -f "$DEPLOY_SCRIPT_PATH" ]]; then
 	echo "[run-project-hooks][ERROR] deploy.deploy_script_path missing or not a file: ${DEPLOY_SCRIPT_PATH:-}" >&2
diff --git a/projects/lecoffreio/conf.json b/projects/lecoffreio/conf.json
index c942602..14ab726 100644
--- a/projects/lecoffreio/conf.json
+++ b/projects/lecoffreio/conf.json
@@ -11,7 +11,7 @@
 		"repository_root": "/home/desk/code/lecoffre_ng_test",
 		"scripts_path": "/home/desk/code/lecoffre_ng_test/deploy/scripts_v2",
 		"deploy_script_path": "/home/desk/code/lecoffre_ng_test/deploy/scripts_v2/deploy.sh",
-		"secrets_path": "/home/desk/code/lecoffre_ng_test/.secrets",
+		"secrets_path": "/home/desk/code/ia_dev/projects/lecoffreio/.secrets",
 		"hooks": {
 			"phases": [
 				"deploy/scripts_v2/deploy.sh"