diff --git a/Containerfile b/Containerfile
index ee77f25..47e115d 100644
--- a/Containerfile
+++ b/Containerfile
@@ -71,6 +71,10 @@ RUN wget https://cdn.filen.io/@filen/desktop/release/latest/Filen_linux_x86_64.r
 	&& dnf clean all \
 	&& rm -f /tmp/filen.rpm
 
+#Reconstruit la politique SELinux compilee depuis le store de modules (sans charger
+#dans le noyau) : sans ca, les modules installes par les paquets (ex: flatpak ->
+#flatpak_helper_exec_t) peuvent manquer et laisser des binaires en "unlabeled_t".
+RUN semodule -n -B
 
 #Installation de starship
 RUN curl -sS https://starship.rs/install.sh | sh -s -- -y
@@ -114,17 +118,16 @@ RUN mkdir -p /etc/dconf/db/local.d /etc/dconf/profile && \
 #Activation du module xpad pour support manette xbox
 RUN echo "xpad" > /etc/modules-load.d/xpad.conf
 
-#Ajout de flathub
-RUN flatpak remote-add --if-not-exists --system flathub https://dl.flathub.org/repo/flathub.flatpakrepo || true
+#Le depot flathub est ajoute au premier demarrage (voir flatpak-first-boot.service) :
+#ecrire dans /var pendant le build est un anti-patron bootc (mauvais labels SELinux).
 
-#Activation du service flatpak-first-boot
+#Activation du service flatpak-first-boot (active apres preset-all, plus bas)
 COPY services/flatpak-first-boot.service /etc/systemd/system/flatpak-first-boot.service
-RUN systemctl enable flatpak-first-boot.service
 
 #Définir le target graphique par défaut
 RUN systemctl set-default graphical.target
 
 #Activation des services + Desactivation de bootc-update automatique
 RUN systemctl preset-all && \
-    systemctl enable --force gdm.service NetworkManager.service bluetooth.service podman.socket cups.service mullvad-daemon.service && \
+    systemctl enable --force gdm.service NetworkManager.service bluetooth.service podman.socket cups.service mullvad-daemon.service flatpak-first-boot.service && \
     systemctl mask bootc-fetch-apply-updates.timer systemd-remount-fs.service
diff --git a/services/flatpak-first-boot.service b/services/flatpak-first-boot.service
index 824de10..26d3c76 100644
--- a/services/flatpak-first-boot.service
+++ b/services/flatpak-first-boot.service
@@ -8,6 +8,7 @@ ConditionPathExists=!/var/lib/flatpak/.firstboot-done
 Type=oneshot
 RemainAfterExit=yes
 ExecStart=/bin/bash -c '\
+    flatpak remote-add --if-not-exists --system flathub https://dl.flathub.org/repo/flathub.flatpakrepo && \
     flatpak install -y --system flathub runtime/org.gnome.Platform/x86_64/49 && \
     flatpak install -y --system flathub io.github.kolunmi.Bazaar && \
     touch /var/lib/flatpak/.firstboot-done'