diff --git a/scripts/inventory_gui.py b/scripts/inventory_gui.py
index dadbc6f..d181c50 100644
--- a/scripts/inventory_gui.py
+++ b/scripts/inventory_gui.py
@@ -101,12 +101,26 @@ INTRANTS_CLES_INTERDITES = {
 }
 # Rappel en lecture seule (jamais de valeur) : secrets a fournir via Ansible Vault.
 SECRETS_ATTENDUS = [
+    # Accès Proxmox (proxmox.vault.yml)
     "proxmox_api_token_id", "proxmox_api_token_secret",
+    # PKI (step-ca)
     "vault_step_ca_password", "vault_step_ca_provisioner_password",
+    # Identité (LDAP / Keycloak)
     "vault_openldap_admin", "vault_ldap_sssd", "vault_keycloak_admin",
-    "vault_postgresql_keycloak", "vault_bd_keycloak", "vault_forgejo_admin",
-    "vault_forgejo_secret_key", "vault_forgejo_internal_token", "vault_bd_forgejo",
-    "vault_grafana_admin", "vault_redis", "vault_bd_icingadb",
+    # Bases de données
+    "vault_postgresql_keycloak", "vault_bd_keycloak", "vault_bd_forgejo",
+    "vault_bd_icingadb", "vault_bd_nextcloud",
+    # Forge (Forgejo)
+    "vault_forgejo_admin", "vault_forgejo_secret_key", "vault_forgejo_internal_token",
+    # Observabilité / cache
+    "vault_grafana_admin", "vault_redis",
+    # Applications (admin)
+    "vault_nextcloud_admin",
+    # Secrets OIDC des clients SSO (un par app fédérée)
+    "vault_grafana_oidc", "vault_forgejo_oidc", "vault_icingaweb2_oidc",
+    "vault_nextcloud_oidc", "vault_oauth2_cookie",
+    # Sauvegarde (restic hors-nœud)
+    "vault_restic_password", "vault_backup_ssh_privkey",
 ]
 
 # Garde-fous des executions (verifier / deployer) depuis l'interface.