diff --git a/scripts/targo-sync/sync_invoices_incremental.py b/scripts/targo-sync/sync_invoices_incremental.py
index 8111896..275a960 100644
--- a/scripts/targo-sync/sync_invoices_incremental.py
+++ b/scripts/targo-sync/sync_invoices_incremental.py
@@ -28,7 +28,7 @@ from html import unescape
 
 # F LIVE (pas le miroir périmé) — lecture bornée par id seulement.
 LEGACY = {"host": os.environ.get("LEGACY_HOST", "10.100.80.100"), "user": "facturation",
-          "password": os.environ.get("LEGACY_PW", "VD67owoj"), "database": "gestionclient",
+          "password": os.environ.get("LEGACY_PW", ""), "database": "gestionclient",  # secret via env (jamais commité)
           "connect_timeout": 30, "read_timeout": 600}
 PG = {"host": os.environ.get("PG_HOST", "db"), "port": 5432, "user": "postgres",
       "password": os.environ.get("PG_PW", "123"), "dbname": os.environ.get("PG_DB", "_eb65bdc0c4b1b2d6")}
diff --git a/scripts/targo-sync/sync_services_incremental.py b/scripts/targo-sync/sync_services_incremental.py
index d692b24..2d2e17f 100644
--- a/scripts/targo-sync/sync_services_incremental.py
+++ b/scripts/targo-sync/sync_services_incremental.py
@@ -27,7 +27,7 @@ from datetime import datetime, timezone, timedelta
 from html import unescape
 
 LEGACY = {"host": os.environ.get("LEGACY_HOST", "10.100.80.100"), "user": "facturation",
-          "password": os.environ.get("LEGACY_PW", "VD67owoj"), "database": "gestionclient",
+          "password": os.environ.get("LEGACY_PW", ""), "database": "gestionclient",  # secret via env (jamais commité)
           "connect_timeout": 30, "read_timeout": 600}
 PG = {"host": os.environ.get("PG_HOST", "db"), "port": 5432, "user": "postgres",
       "password": os.environ.get("PG_PW", "123"), "dbname": os.environ.get("PG_DB", "_eb65bdc0c4b1b2d6")}
diff --git a/scripts/targo-sync/tickets-daily.sh b/scripts/targo-sync/tickets-daily.sh
new file mode 100644
index 0000000..e15ce08
--- /dev/null
+++ b/scripts/targo-sync/tickets-daily.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+# Import QUOTIDIEN incrémental des tickets F → ERPNext Issue.
+# migrate_tickets.py est idempotent (skip par legacy_ticket_id) : ne crée que les nouveaux.
+# Complète le rattrapage 2026-07-06. Séparé du cron horaire run.sh (le scan de 252k tickets
+# est trop lourd pour l'horaire ; quotidien suffit — les tickets s'accumulent lentement).
+#
+# Déploiement (hôte) :
+#   scp scripts/migration/migrate_tickets.py root@<prod>:/opt/targo-sync/migrate_tickets.py
+#   scp scripts/targo-sync/tickets-daily.sh  root@<prod>:/opt/targo-sync/ && chmod +x /opt/targo-sync/tickets-daily.sh
+#   echo 'LEGACY_PW=<mdp F>' > /opt/targo-sync/secrets.env && chmod 600 /opt/targo-sync/secrets.env   # secret HORS repo
+#   crontab: 30 4 * * * /opt/targo-sync/tickets-daily.sh
+set -uo pipefail
+DIR=/opt/targo-sync
+LOG="$DIR/tickets-sync.log"
+[ -f "$LOG" ] && tail -n 2000 "$LOG" > "$LOG.tmp" 2>/dev/null && mv "$LOG.tmp" "$LOG"
+exec >> "$LOG" 2>&1
+echo "===== $(date -Is) tickets-daily ====="
+exec 9>"$DIR/.tickets.lock"
+flock -n 9 || { echo "déjà en cours, skip"; exit 0; }
+# secret (LEGACY_PW) chargé depuis un fichier hôte non versionné
+[ -f "$DIR/secrets.env" ] && . "$DIR/secrets.env"
+docker cp "$DIR/migrate_tickets.py" erpnext-backend-1:/tmp/migrate_tickets.py 2>/dev/null
+docker exec -e LEGACY_PW="${LEGACY_PW:-}" -e LEGACY_HOST="${LEGACY_HOST:-10.100.80.100}" -e PG_HOST=db \
+  erpnext-backend-1 /home/frappe/frappe-bench/env/bin/python /tmp/migrate_tickets.py 2>&1 | tail -12
+echo "done $(date -Is)"