diff --git a/app/services/qualys_service.py b/app/services/qualys_service.py
index 995b4f8..ca6ce84 100644
--- a/app/services/qualys_service.py
+++ b/app/services/qualys_service.py
@@ -586,6 +586,10 @@ def refresh_all_agents(db):
             srv = db.execute(text("SELECT id FROM servers WHERE LOWER(hostname)=LOWER(:h)"),
                              {"h": hostname}).fetchone()
             server_id = srv.id if srv else None
+            # Sync du FQDN Qualys vers servers.fqdn si présent
+            if server_id and fqdn:
+                db.execute(text("UPDATE servers SET fqdn=:fqdn WHERE id=:sid AND (fqdn IS NULL OR fqdn='')"),
+                           {"fqdn": fqdn, "sid": server_id})
 
             existing = db.execute(text("SELECT id FROM qualys_assets WHERE qualys_asset_id=:qid"),
                                   {"qid": int(asset_id)}).fetchone()
diff --git a/app/services/realtime_audit_service.py b/app/services/realtime_audit_service.py
index 7bcfca7..41be221 100644
--- a/app/services/realtime_audit_service.py
+++ b/app/services/realtime_audit_service.py
@@ -97,6 +97,27 @@ def _ordered_suffixes(hostname):
 
 
 def _resolve(hostname):
+    # 1. Essaie d'abord le FQDN stocké en base (issu de Qualys ou iTop)
+    try:
+        from .secrets_service import get_secret  # noqa
+        from ..database import SessionLocal
+        db = SessionLocal()
+        row = db.execute(text("SELECT fqdn FROM servers WHERE LOWER(hostname)=LOWER(:h) AND fqdn IS NOT NULL AND fqdn != ''"),
+                         {"h": hostname}).fetchone()
+        db.close()
+        if row and row.fqdn:
+            try:
+                sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+                sock.settimeout(2)
+                r = sock.connect_ex((row.fqdn, 22))
+                sock.close()
+                if r == 0:
+                    return row.fqdn
+            except Exception:
+                pass
+    except Exception:
+        pass
+    # 2. Fallback : boucle sur les suffixes DNS
     for suffix in _ordered_suffixes(hostname):
         target = hostname + suffix
         try: