diff --git a/app/services/realtime_audit_service.py b/app/services/realtime_audit_service.py
index 1be5ca4..3d9db59 100644
--- a/app/services/realtime_audit_service.py
+++ b/app/services/realtime_audit_service.py
@@ -833,13 +833,16 @@ def _analyze_qualys_audit(r):
             "title": "Installation Qualys cassée (core dump + package absent du RPM)",
             "fix": "Le service systemd existe mais le binaire est manquant ou corrompu "
                    "→ core dump en boucle. Désinstaller proprement puis réinstaller :\n\n"
+                   "1. Cleanup :\n"
                    "sudo systemctl stop qualys-cloud-agent\n"
                    "sudo systemctl disable qualys-cloud-agent\n"
+                   "sudo rpm -e qualys-cloud-agent 2>/dev/null  # si package partiel\n"
                    "sudo rm -rf /usr/local/qualys /var/log/qualys /etc/qualys\n"
                    "sudo rm -f /usr/lib/systemd/system/qualys-cloud-agent.service\n"
                    "sudo systemctl daemon-reload && sudo systemctl reset-failed\n\n"
-                   "Puis réinstaller via le script Qualys (ActivationId + CustomerId "
-                   "depuis console qualysguard.qg2.apps.qualys.eu)."
+                   "2. Réinstall (procédure SANEF) :\n"
+                   "sudo rpm -ivh /root/QualysCloudAgent.rpm\n\n"
+                   "3. Activation (script Qualys avec ActivationId + CustomerId depuis console qualysguard.qg2.apps.qualys.eu)."
         })
     elif "core-dump" in s_sys or "core dumped" in s_sys:
         suggestions.append({