diff --git a/app/routers/audit.py b/app/routers/audit.py
index fd017ad..1a50a5c 100644
--- a/app/routers/audit.py
+++ b/app/routers/audit.py
@@ -139,9 +139,10 @@ async def audit_global(request: Request, db=Depends(get_db)):
     # Matche sur domaine plain-text (via d.name) ou via d.code legacy
     # et accepte les serveurs sans domaine attribue (ne pas penaliser le NULL)
     if exclude_domains:
+        # Compare sur domaine plain-text puis fallback jointure. NULL = exclu.
         where.append(
-            "(COALESCE(s.domaine, d.name, d.code, '') NOT IN :ed "
-            "OR COALESCE(s.domaine, d.name, d.code, '') = '')"
+            "COALESCE(s.domaine, d.name, d.code) IS NOT NULL "
+            "AND COALESCE(s.domaine, d.name, d.code) NOT IN :ed"
         )
         params["ed"] = tuple(exclude_domains)
     if exclude_zones: