FEDERATION.md
diff --git a/FEDERATION.md b/FEDERATION.md
index 398b955..45a4083 100644
--- a/FEDERATION.md
+++ b/FEDERATION.md
@@ -65,9 +65,14 @@ ou le certificat présenté compte. Thomas installe l'outil de
renouvellement (build direct, sans cloner le dépôt) :
```sh
-go install git.neuromancer.ovh/bastien-mrq/gitfed/cmd/gitfed-renew-cert@main
+GOPRIVATE=git.neuromancer.ovh/* go install git.neuromancer.ovh/bastien-mrq/gitfed/cmd/gitfed-renew-cert@latest
```
+`GOPRIVATE` dit à l'outil `go` de sauter le proxy public
+(`proxy.golang.org`) et la base de sommes de contrôle pour ce chemin —
+nécessaire pour tout module auto-hébergé, pas seulement celui-ci. Pour ne
+plus avoir à le préciser à chaque fois : `go env -w GOPRIVATE=git.neuromancer.ovh/*`.
+
Puis récupère la clé d'hôte de **sa propre** instance et demande un
premier certificat :
deploy/update.sh
diff --git a/deploy/update.sh b/deploy/update.sh
index 080bb97..951f5eb 100755
--- a/deploy/update.sh
+++ b/deploy/update.sh
@@ -12,7 +12,12 @@
#
# Add the new version's entry to CHANGELOG.md yourself before running this
# — the script won't guess what changed. It commits the VERSION bump (and
-# CHANGELOG.md, if you've staged it) as "Release vX.Y.Z".
+# CHANGELOG.md, if you've staged it) as "Release vX.Y.Z", and tags the
+# final "Deploy vX.Y.Z" commit "vX.Y.Z" — that tag is what makes
+# `go install .../gitfed/cmd/<tool>@latest` resolve to something instead
+# of erroring "no matching versions" (see FEDERATION.md). Nothing here
+# pushes to the remote, including the tag — that's still a separate
+# `git push vps main --tags` afterward, same as always.
set -euo pipefail
cd "$(dirname "${BASH_SOURCE[0]}")/.."
@@ -67,5 +72,6 @@ ssh "$VPS_HOST" "kubectl -n $NAMESPACE apply -f $VPS_SRC_DIR/deploy/k8s/deployme
git add deploy/k8s/deployment.yaml
git commit -m "Deploy v$new_version"
+git tag "v$new_version"
-echo "==> done: v$new_version is live"
+echo "==> done: v$new_version is live (tagged v$new_version — push with: git push vps main --tags)"