diff --git a/deploy/lib/README.md b/deploy/lib/README.md
index 9d66894..5b6b140 100644
--- a/deploy/lib/README.md
+++ b/deploy/lib/README.md
@@ -7,7 +7,7 @@ Canonical SSH/SCP helpers (`ssh_run`, `scp_copy`, `require_ssh_key`, `ssh_common
 
 ## `deploy-log.sh`
 
-Optional `deploy_script_tee_log_if_requested <project_root> <log_subdir>` — requires `info` from the project’s `colors.sh` (sourced before this file in `deploy.sh`).
+Optional `deploy_script_tee_log_if_requested <project_root> <log_subdir> [deploy_env]` — third arg `test` \| `pprod` \| `prod` sets the log filename `deploy_<env>_…` and a header line. Requires `info` from the project’s `colors.sh` (sourced before this file in `deploy.sh`). `DEPLOY_STARTED_AT` in the shell is echoed in the header when set.
 
 ## Policy
 
diff --git a/deploy/lib/deploy-log.sh b/deploy/lib/deploy-log.sh
index 8a79399..0b5401d 100644
--- a/deploy/lib/deploy-log.sh
+++ b/deploy/lib/deploy-log.sh
@@ -1,16 +1,26 @@
 #!/usr/bin/env bash
 # Optional tee of deploy output to a log file under the project root.
 
-# Args: project_root log_to_dir_relative (empty = skip)
+# Args: project_root log_to_dir_relative [deploy_env]
+# If deploy_env is set (test|pprod|prod), log file is deploy_<env>_YYYYMMDD_HHMMSS.log and starts with a header.
 deploy_script_tee_log_if_requested() {
 	local project_root="${1:?}"
 	local log_to_dir="${2:-}"
+	local deploy_env="${3:-}"
 	if [[ -z "$log_to_dir" ]]; then
 		return 0
 	fi
 	mkdir -p "${project_root}/${log_to_dir}"
 	local log_file
-	log_file="${project_root}/${log_to_dir}/deploy_$(date +%Y%m%d_%H%M%S).log"
+	if [[ -n "$deploy_env" ]]; then
+		log_file="${project_root}/${log_to_dir}/deploy_${deploy_env}_$(date +%Y%m%d_%H%M%S).log"
+	else
+		log_file="${project_root}/${log_to_dir}/deploy_$(date +%Y%m%d_%H%M%S).log"
+	fi
+	{
+		printf '%s\n' "=== LeCoffre deploy log ==="
+		printf '%s\n' "environment=${deploy_env:-<unset>} started_at=${DEPLOY_STARTED_AT:-} project_root=${project_root}"
+	} >"$log_file"
+	exec > >(tee -a "$log_file")
 	info "[deploy] Teeing output to ${log_file}"
-	exec > >(tee "$log_file")
 }