diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 6af6cfe..29f5814 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -62,3 +62,23 @@ jobs:
           docker push "${IMAGE}:${SHORT_SHA}"
           docker push "${IMAGE}:latest"
           echo "pushed ${IMAGE}:${SHORT_SHA} and :latest"
+
+      - name: Push Docker Hub (si secrets présents)
+        env:
+          DOCKER_HUB_USER: ${{ secrets.DOCKER_HUB_USER }}
+          DOCKER_HUB_TOKEN: ${{ secrets.DOCKER_HUB_TOKEN }}
+        run: |
+          set -eu
+          if [ -z "${DOCKER_HUB_TOKEN:-}" ] || [ -z "${DOCKER_HUB_USER:-}" ]; then
+            echo "Pas de secrets DOCKER_HUB_* : skip (prod k3s reste sur l'image Docker Hub existante)."
+            exit 0
+          fi
+          echo "${DOCKER_HUB_TOKEN}" | docker login docker.io -u "${DOCKER_HUB_USER}" --password-stdin
+          SHORT_SHA="$(echo "${GITHUB_SHA}" | cut -c1-12)"
+          SRC="${GITHUB_SERVER_URL#https://}/grgmro/oc-p07-sentiment-api"
+          DST="docker.io/${DOCKER_HUB_USER}/sentiment_api"
+          docker tag "${SRC}:latest" "${DST}:latest"
+          docker tag "${SRC}:latest" "${DST}:${SHORT_SHA}"
+          docker push "${DST}:latest"
+          docker push "${DST}:${SHORT_SHA}"
+          echo "pushed ${DST}:latest"