diff --git a/deploy/branch-align.sh b/deploy/branch-align.sh
index 02907b0..b45f8d0 100755
--- a/deploy/branch-align.sh
+++ b/deploy/branch-align.sh
@@ -14,11 +14,10 @@ if [[ -n "${1:-}" && -f "${IA_DEV_ROOT}/projects/${1}/conf.json" && ! "$1" =~ ^(
 	# shellcheck source=../lib/project_config.sh
 	source "${IA_DEV_ROOT}/lib/project_config.sh"
 	[[ -n "${PROJECT_ID:-}" ]] && export IA_PROJECT_ID="$PROJECT_ID"
-	PROJECT_ROOT=""
-	if [[ -n "${PROJECT_CONFIG_PATH:-}" && -f "${PROJECT_CONFIG_PATH:-}" ]] && command -v jq >/dev/null 2>&1; then
-		_secrets_path="$(jq -r '.deploy.secrets_path // ""' "$PROJECT_CONFIG_PATH" 2>/dev/null)"
-		[[ -n "$_secrets_path" ]] && PROJECT_ROOT="$(dirname "$_secrets_path")"
-	fi
+	# shellcheck source=../lib/project_git_root_from_conf.sh
+	source "${IA_DEV_ROOT}/lib/project_git_root_from_conf.sh"
+	ia_dev_resolve_project_git_root
+	PROJECT_ROOT="${IA_PROJECT_GIT_ROOT:-}"
 	if [[ -z "$PROJECT_ROOT" || ! -d "$PROJECT_ROOT" ]]; then
 		echo "[branch-align][ERROR] Could not resolve project root for project_id ${IA_PROJECT_ID}" >&2
 		exit 1
diff --git a/deploy/change-to-all-branches.sh b/deploy/change-to-all-branches.sh
index 1432681..05cb842 100755
--- a/deploy/change-to-all-branches.sh
+++ b/deploy/change-to-all-branches.sh
@@ -14,11 +14,10 @@ if [[ -n "${1:-}" && -f "${IA_DEV_ROOT}/projects/${1}/conf.json" ]]; then
 	# shellcheck source=../lib/project_config.sh
 	source "${IA_DEV_ROOT}/lib/project_config.sh"
 	[[ -n "${PROJECT_ID:-}" ]] && export IA_PROJECT_ID="$PROJECT_ID"
-	PROJECT_ROOT=""
-	if [[ -n "${PROJECT_CONFIG_PATH:-}" && -f "${PROJECT_CONFIG_PATH:-}" ]] && command -v jq >/dev/null 2>&1; then
-		_secrets_path="$(jq -r '.deploy.secrets_path // ""' "$PROJECT_CONFIG_PATH" 2>/dev/null)"
-		[[ -n "$_secrets_path" ]] && PROJECT_ROOT="$(dirname "$_secrets_path")"
-	fi
+	# shellcheck source=../lib/project_git_root_from_conf.sh
+	source "${IA_DEV_ROOT}/lib/project_git_root_from_conf.sh"
+	ia_dev_resolve_project_git_root
+	PROJECT_ROOT="${IA_PROJECT_GIT_ROOT:-}"
 	if [[ -z "$PROJECT_ROOT" || ! -d "$PROJECT_ROOT" ]]; then
 		echo "[change-to-all-branches][ERROR] Could not resolve project root for project_id ${IA_PROJECT_ID}" >&2
 		exit 1
diff --git a/deploy/deploy-by-script-to.sh b/deploy/deploy-by-script-to.sh
index 4430df9..b65abb6 100755
--- a/deploy/deploy-by-script-to.sh
+++ b/deploy/deploy-by-script-to.sh
@@ -14,13 +14,10 @@ if [[ -n "${1:-}" && ! "$1" =~ ^(pprod|prod)$ && -f "${IA_DEV_ROOT}/projects/${1
 fi
 # shellcheck source=../lib/project_config.sh
 source "${IA_DEV_ROOT}/lib/project_config.sh"
-PROJECT_ROOT=""
-if [[ -n "${PROJECT_ID:-}" && -f "${PROJECT_CONFIG_PATH:-}" ]] && command -v jq >/dev/null 2>&1; then
-	_secrets_path="$(jq -r '.deploy.secrets_path // ""' "$PROJECT_CONFIG_PATH" 2>/dev/null)"
-	if [[ -n "$_secrets_path" ]]; then
-		PROJECT_ROOT="$(dirname "$_secrets_path")"
-	fi
-fi
+# shellcheck source=../lib/project_git_root_from_conf.sh
+source "${IA_DEV_ROOT}/lib/project_git_root_from_conf.sh"
+ia_dev_resolve_project_git_root
+PROJECT_ROOT="${IA_PROJECT_GIT_ROOT:-}"
 if [[ -z "$PROJECT_ROOT" || ! -d "$PROJECT_ROOT" ]]; then
 	PROJECT_ROOT="$(cd "$DEPLOY_IA/../.." && pwd)"
 fi
diff --git a/deploy/pousse.sh b/deploy/pousse.sh
index d844360..932f2bb 100755
--- a/deploy/pousse.sh
+++ b/deploy/pousse.sh
@@ -99,12 +99,11 @@ repo_root="$(git rev-parse --show-toplevel)"
 # When run from ia_dev root, use configured project repo for git operations (MAIL_TO or AI_AGENT_TOKEN must be set)
 git_work_root="$repo_root"
 if [[ -n "${PROJECT_CONFIG_PATH:-}" && -f "$PROJECT_CONFIG_PATH" ]] && command -v jq >/dev/null 2>&1 && [[ "$repo_root" == "$IA_DEV_ROOT" ]]; then
-	_secrets_path="$(jq -r '.deploy.secrets_path // ""' "$PROJECT_CONFIG_PATH" 2>/dev/null)"
-	if [[ -n "$_secrets_path" ]]; then
-		_gwr="$(dirname "$_secrets_path")"
-		if [[ -d "$_gwr" ]]; then
-			git_work_root="$_gwr"
-		fi
+	# shellcheck source=../lib/project_git_root_from_conf.sh
+	source "${IA_DEV_ROOT}/lib/project_git_root_from_conf.sh"
+	ia_dev_resolve_project_git_root
+	if [[ -n "${IA_PROJECT_GIT_ROOT:-}" && -d "$IA_PROJECT_GIT_ROOT" ]]; then
+		git_work_root="$IA_PROJECT_GIT_ROOT"
 	fi
 fi
 if [[ "$(pwd)" != "$git_work_root" ]]; then
diff --git a/lib/project_git_root_from_conf.sh b/lib/project_git_root_from_conf.sh
new file mode 100644
index 0000000..f776014
--- /dev/null
+++ b/lib/project_git_root_from_conf.sh
@@ -0,0 +1,36 @@
+#
+# Resolve the application git repository root from projects/<id>/conf.json.
+# Used by ia_dev deploy wrappers (pousse, branch-align, change-to-all-branches, deploy-by-script-to).
+#
+# Priority:
+#   1. deploy.repository_root (preferred)
+#   2. deploy.git_work_tree (alias)
+#   3. dirname(deploy.secrets_path) — legacy; breaks if secrets live outside the repo tree
+#
+# Preconditions: PROJECT_CONFIG_PATH set and jq available.
+# Sets: IA_PROJECT_GIT_ROOT (exported), or empty if unresolved.
+#
+ia_dev_resolve_project_git_root() {
+	IA_PROJECT_GIT_ROOT=""
+	export IA_PROJECT_GIT_ROOT
+	if [[ -z "${PROJECT_CONFIG_PATH:-}" || ! -f "$PROJECT_CONFIG_PATH" ]]; then
+		return 0
+	fi
+	if ! command -v jq >/dev/null 2>&1; then
+		return 0
+	fi
+	local r sp
+	r="$(jq -r '.deploy.repository_root // .deploy.git_work_tree // empty' "$PROJECT_CONFIG_PATH" 2>/dev/null || true)"
+	r="${r//$'\r'/}"
+	if [[ -n "$r" && "$r" != "null" && -d "$r" ]]; then
+		IA_PROJECT_GIT_ROOT="$r"
+		export IA_PROJECT_GIT_ROOT
+		return 0
+	fi
+	sp="$(jq -r '.deploy.secrets_path // empty' "$PROJECT_CONFIG_PATH" 2>/dev/null || true)"
+	sp="${sp//$'\r'/}"
+	if [[ -n "$sp" && "$sp" != "null" ]]; then
+		IA_PROJECT_GIT_ROOT="$(dirname "$sp")"
+		export IA_PROJECT_GIT_ROOT
+	fi
+}
diff --git a/projects/lecoffreio/conf.json b/projects/lecoffreio/conf.json
index ce18bbc..ef7dd38 100644
--- a/projects/lecoffreio/conf.json
+++ b/projects/lecoffreio/conf.json
@@ -3,19 +3,23 @@
 	"name": "Lecoffre.io",
 	"project_path": "/home/desk/code/lecoffre_ng_test/deploy",
 	"build_dirs": [
-		"/home/desk/code/lecoffre_ng_test/deploy/lecoffre-ressources-dev",
-		"/home/desk/code/lecoffre_ng_test/deploy/lecoffre-back-main",
-		"/home/desk/code/lecoffre_ng_test/deploy/lecoffre-front-main"
+		"/home/desk/code/lecoffre_ng_test/lecoffre-ressources-dev",
+		"/home/desk/code/lecoffre_ng_test/lecoffre-back-main",
+		"/home/desk/code/lecoffre_ng_test/lecoffre-front-main"
 	],
 	"deploy": {
+		"repository_root": "/home/desk/code/lecoffre_ng_test",
 		"scripts_path": "/home/desk/code/lecoffre_ng_test/deploy/scripts_v2",
 		"deploy_script_path": "/home/desk/code/lecoffre_ng_test/deploy/scripts_v2/deploy.sh",
-		"secrets_path": "/home/desk/code/lecoffre_ng_test/.secrets"
+		"secrets_path": "/home/desk/code/lecoffre_ng_test/.secrets",
+		"hooks": {
+			"phases": []
+		}
 	},
 	"version": {
 		"package_json_paths": [
-			"/home/desk/code/lecoffre_ng_test/deploy/lecoffre-back-main/package.json",
-			"/home/desk/code/lecoffre_ng_test/deploy/lecoffre-front-main/package.json"
+			"/home/desk/code/lecoffre_ng_test/lecoffre-back-main/package.json",
+			"/home/desk/code/lecoffre_ng_test/lecoffre-front-main/package.json"
 		],
 		"splash_app_name": "LeCoffre.io"
 	},