diff --git a/api/config/custom-environment-variables.mjs b/api/config/custom-environment-variables.mjs
index 37476549..b853573b 100644
--- a/api/config/custom-environment-variables.mjs
+++ b/api/config/custom-environment-variables.mjs
@@ -13,10 +13,12 @@ export default {
   port: 'PORT',
   privateDirectoryUrl: 'PRIVATE_DIRECTORY_URL',
   privateEventsUrl: 'PRIVATE_EVENTS_URL',
+  privateRegistryUrl: 'PRIVATE_REGISTRY_URL',
   secretKeys: {
     limits: 'SECRET_LIMITS',
     events: 'SECRET_EVENTS',
-    identities: 'SECRET_IDENTITIES'
+    identities: 'SECRET_IDENTITIES',
+    registry: 'SECRET_REGISTRY'
   },
   observer: {
     active: 'OBSERVER_ACTIVE',
diff --git a/api/config/default.mjs b/api/config/default.mjs
index 3f7f83d1..be441fae 100644
--- a/api/config/default.mjs
+++ b/api/config/default.mjs
@@ -1,7 +1,10 @@
 export default {
   cipherPassword: undefined,
-  dataDir: '/app/data',
-  tmpDir: null, // will be dataDir + '/tmp' if null
+  // Optional. When set, the legacy plugins volume at <dataDir>/plugins is read
+  // by the v6.0 boot migration. Drops with v7.0.
+  dataDir: null,
+  // Defaults to <dataDir>/tmp when dataDir is set, else <os.tmpdir>/data-fair-processings.
+  tmpDir: null,
   defaultLimits: {
     // Maximum time spent running processings
     // -1 for unlimited storage
@@ -10,10 +13,16 @@ export default {
   pluginCategories: ['Essentiels', 'Mes plugins', 'Données de références', 'Tests'],
   privateDirectoryUrl: 'http://simple-directory:8080',
   privateEventsUrl: undefined,
+  // Internal URL the API uses for server-to-server calls to registry. The UI
+  // talks to /registry on the same domain (no public URL is configurable).
+  privateRegistryUrl: 'http://registry:8080',
   secretKeys: {
     limits: null,
     events: undefined,
-    identities: undefined
+    identities: undefined,
+    // x-secret-key shared with registry. Required for save-time validation,
+    // prepare-hook downloads, and the v6.0 first-boot migration.
+    registry: undefined
   },
   mongoUrl: 'mongodb://localhost:27017/data-fair-processings',
   port: 8080,
diff --git a/api/config/development.mjs b/api/config/development.mjs
index d89fdd38..0958cc36 100644
--- a/api/config/development.mjs
+++ b/api/config/development.mjs
@@ -2,6 +2,7 @@ const apiPort = parseInt(process.env.DEV_API_PORT ?? '8082')
 const mongoPort = process.env.MONGO_PORT ?? '27017'
 const sdPort = process.env.SD_PORT ?? '8080'
 const eventsPort = process.env.EVENTS_PORT ?? '8083'
+const registryPort = process.env.REGISTRY_PORT ?? '8085'
 const observerPort = parseInt(process.env.DEV_API_OBSERVER_PORT ?? '9092')
 
 export default {
@@ -14,8 +15,10 @@ export default {
   port: apiPort,
   privateDirectoryUrl: `http://localhost:${sdPort}`,
   privateEventsUrl: `http://localhost:${eventsPort}`,
+  privateRegistryUrl: `http://localhost:${registryPort}/registry`,
   secretKeys: {
     identities: 'secret-identities',
-    events: 'secret-events'
+    events: 'secret-events',
+    registry: 'secret-registry-internal'
   }
 }
diff --git a/api/config/type/schema.json b/api/config/type/schema.json
index 8c913248..9e8c1f41 100644
--- a/api/config/type/schema.json
+++ b/api/config/type/schema.json
@@ -12,8 +12,8 @@
   "additionalProperties": false,
   "required": [
     "cipherPassword",
-    "dataDir",
     "privateDirectoryUrl",
+    "privateRegistryUrl",
     "mongoUrl",
     "pluginCategories",
     "port",
@@ -25,7 +25,8 @@
       "type": "string"
     },
     "dataDir": {
-      "type": "string"
+      "type": ["string", "null"],
+      "description": "Optional. When set, the legacy plugins volume at <dataDir>/plugins is read by the v6.0 boot migration. Drops with v7.0."
     },
     "tmpDir": {
       "type": "string"
@@ -57,8 +58,14 @@
     "privateEventsUrl": {
       "type": "string"
     },
+    "privateRegistryUrl": {
+      "type": "string",
+      "pattern": "^https?://",
+      "description": "Internal URL used by the API to call registry server-to-server. The UI hits /registry on the same domain."
+    },
     "secretKeys": {
       "type": "object",
+      "required": ["registry"],
       "properties": {
         "limits": {
           "type": [
@@ -71,6 +78,10 @@
         },
         "identities": {
           "type": "string"
+        },
+        "registry": {
+          "type": "string",
+          "description": "x-secret-key shared with registry. Required for save-time validation, prepare-hook downloads, and the v6.0 first-boot migration."
         }
       }
     },
@@ -97,4 +108,4 @@
     "get": {},
     "has": {}
   }
-}
\ No newline at end of file
+}
diff --git a/api/doc/plugin/post-req/index.ts b/api/doc/plugin/post-req/index.ts
deleted file mode 100644
index f5d615bd..00000000
--- a/api/doc/plugin/post-req/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export * from './.type/index.js'
diff --git a/api/doc/plugin/post-req/schema.js b/api/doc/plugin/post-req/schema.js
deleted file mode 100644
index f6c972d8..00000000
--- a/api/doc/plugin/post-req/schema.js
+++ /dev/null
@@ -1,21 +0,0 @@
-import jsonSchema from '@data-fair/lib-utils/json-schema.js'
-import PluginSchema from '#types/plugin/schema.js'
-
-export default {
-  $id: 'https://github.com/data-fair/processings/plugin/post-req',
-  title: 'Post processing req',
-  'x-exports': ['validate', 'types'],
-  type: 'object',
-  required: ['body'],
-  properties: {
-    body:
-      jsonSchema(PluginSchema)
-        .pickProperties(['distTag', 'name', 'version', 'description'])
-        .removeFromRequired([
-          'description'
-        ])
-        .removeId()
-        .appendTitle(' post')
-        .schema
-  }
-}
diff --git a/api/package.json b/api/package.json
index 71d0ee60..ea10ec6b 100644
--- a/api/package.json
+++ b/api/package.json
@@ -23,6 +23,7 @@
   "dependencies": {
     "@data-fair/lib-express": "^1.22.5",
     "@data-fair/lib-node": "^2.12.1",
+    "@data-fair/lib-node-registry": "^0.4.0",
     "@data-fair/lib-utils": "^1.10.1",
     "@data-fair/processings-shared": "*",
     "ajv": "^8.17.1",
diff --git a/api/src/admin/status.ts b/api/src/admin/status.ts
index 2e03ddb1..fb962ea5 100644
--- a/api/src/admin/status.ts
+++ b/api/src/admin/status.ts
@@ -8,11 +8,13 @@ const volumeStatus = async () => {
   await fs.writeFile(`${config.dataDir}/check-access.txt`, 'ok')
 }
 
-export const getStatus = async (req: Request) =>
-  runHealthChecks(req, [
-    { fn: mongoStatus, name: 'mongodb' },
-    { fn: volumeStatus, name: 'data volume' }
-  ])
+export const getStatus = async (req: Request) => {
+  const checks: Array<{ fn: (req: Request) => Promise<void>; name: string }> = [
+    { fn: mongoStatus, name: 'mongodb' }
+  ]
+  if (config.dataDir) checks.push({ fn: volumeStatus, name: 'data volume' })
+  return runHealthChecks(req, checks)
+}
 
 // Helper functions
 const getSingleStatus = async (req: Request, fn: (req: Request) => Promise<void>, name: string) => {
diff --git a/api/src/app.ts b/api/src/app.ts
index b9491735..dfe02a7b 100644
--- a/api/src/app.ts
+++ b/api/src/app.ts
@@ -3,8 +3,6 @@ import express from 'express'
 import { session, errorHandler, createSiteMiddleware, createSpaMiddleware, defaultNonceCSPDirectives } from '@data-fair/lib-express/index.js'
 import identitiesRouter from './misc/routers/identities.ts'
 import limitsRouter from './limits/router.ts'
-import pluginsRegistryRouter from './plugins-registry/router.ts'
-import pluginsRouter from './plugins/router.ts'
 import processingsRouter from './processings/router.ts'
 import runsRouter from './runs/router.ts'
 import adminRouter from './admin/router.ts'
@@ -28,8 +26,6 @@ app.get('/api/v1/_ping', (req, res) => {
 })
 
 app.use('/api/identities', identitiesRouter)
-app.use('/api/v1/plugins-registry', pluginsRegistryRouter)
-app.use('/api/v1/plugins', pluginsRouter)
 app.use('/api/v1/processings', processingsRouter)
 app.use('/api/v1/runs', runsRouter)
 app.use('/api/v1/limits', limitsRouter)
diff --git a/api/src/config.ts b/api/src/config.ts
index b134db30..902d1431 100644
--- a/api/src/config.ts
+++ b/api/src/config.ts
@@ -1,13 +1,27 @@
+import path from 'node:path'
+import os from 'node:os'
 import type { ApiConfig } from '../config/type/index.ts'
 import { assertValid } from '../config/type/index.ts'
 import config from 'config'
 
 assertValid(config, { lang: 'en', name: 'config', internal: true })
 
-const apiConfig = config as unknown as ApiConfig
+const rawConfig = config as unknown as ApiConfig
+
+if (!rawConfig.tmpDir) {
+  rawConfig.tmpDir = rawConfig.dataDir
+    ? path.join(rawConfig.dataDir, 'tmp')
+    : path.join(os.tmpdir(), 'data-fair-processings')
+}
+
+const apiConfig = rawConfig as ApiConfig & { tmpDir: string }
+
+// cacheDir is always a subdirectory of tmpDir.
+export const registryCacheDir = path.join(apiConfig.tmpDir, 'registry-cache')
+
 export default apiConfig
 
 export const uiConfig = {
-  pluginCategories: apiConfig.pluginCategories,
+  pluginCategories: apiConfig.pluginCategories
 }
 export type UiConfig = typeof uiConfig
diff --git a/api/src/misc/routers/test-env.ts b/api/src/misc/routers/test-env.ts
index 6684d526..1f49d755 100644
--- a/api/src/misc/routers/test-env.ts
+++ b/api/src/misc/routers/test-env.ts
@@ -51,6 +51,23 @@ router.get('/raw-processing/:id', async (req, res, next) => {
   }
 })
 
+// Patch a processing document without validation (used by tests to put a
+// processing into states that the normal API guards prevent, e.g. setting
+// plugin to a value that doesn't resolve in the registry).
+router.patch('/raw-processing/:id', async (req, res, next) => {
+  try {
+    const result = await mongo.processings.updateOne(
+      { _id: req.params.id },
+      { $set: req.body }
+    )
+    if (result.matchedCount === 0) return res.status(404).json({ error: 'processing not found' })
+    const processing = await mongo.processings.findOne({ _id: req.params.id })
+    res.json(processing)
+  } catch (err) {
+    next(err)
+  }
+})
+
 // Return the raw MongoDB document for a run
 router.get('/raw-run/:id', async (req, res, next) => {
   try {
@@ -93,11 +110,14 @@ router.post('/set-config', (req, res, next) => {
   }
 })
 
-// Wipe the installed plugins directory (used between test runs)
+// Wipe the installed plugins directory (used between test runs).
+// No-op when the legacy plugins volume isn't mounted (config.dataDir unset).
 router.delete('/plugins', async (req, res, next) => {
   try {
-    const pluginsDir = path.resolve(config.dataDir, 'plugins')
-    await fs.emptyDir(pluginsDir)
+    if (config.dataDir) {
+      const pluginsDir = path.resolve(config.dataDir, 'plugins')
+      await fs.emptyDir(pluginsDir)
+    }
     res.json({ ok: true })
   } catch (err) {
     next(err)
diff --git a/api/src/misc/utils/api-docs.ts b/api/src/misc/utils/api-docs.ts
index 612a1af9..775981b2 100644
--- a/api/src/misc/utils/api-docs.ts
+++ b/api/src/misc/utils/api-docs.ts
@@ -1,6 +1,5 @@
 import jsonSchema from '@data-fair/lib-utils/json-schema.js'
 import { type Processing, resolvedSchema as ProcessingSchema } from '#types/processing/index.ts'
-import { type Plugin, resolvedSchema as PluginSchema } from '#types/plugin/index.ts'
 import { readFileSync } from 'node:fs'
 import path from 'path'
 
@@ -8,7 +7,10 @@ const packageJson = JSON.parse(readFileSync(path.resolve(import.meta.dirname, '.
 
 // CTRL + K CTRL + 4 to fold operations levels
 
-export default (origin: string, options?: { processing?: Processing, plugin?: Plugin }) => {
+// In v6 the API only needs the plugin's name, version and processingConfigSchema.
+type ApiDocPlugin = { name: string, version: string, processingConfigSchema?: Record<string, unknown> }
+
+export default (origin: string, options?: { processing?: Processing, plugin?: ApiDocPlugin }) => {
   if (options?.plugin?.processingConfigSchema) ProcessingSchema.properties.config = options?.plugin?.processingConfigSchema
 
   const doc: Record<string, any> = {
@@ -202,7 +204,7 @@ export default (origin: string, options?: { processing?: Processing, plugin?: Pl
                   .appendTitle(' post')
                   .schema,
                 example: {
-                  plugin: '@data-fair/processing-export-file',
+                  plugin: '@data-fair-processing-export-file-1',
                   owner: {
                     type: 'organization',
                     id: 'koumoul',
@@ -592,317 +594,6 @@ export default (origin: string, options?: { processing?: Processing, plugin?: Pl
           }
         }
       },
-
-      '/plugins-registry': {
-        get: {
-          summary: 'Obtenir la liste des plugins',
-          description: 'Accéder à la liste des plugins disponibles sur NPM.',
-          operationId: 'getPluginsRegistry',
-          tags: ['Plugins'],
-          parameters: [
-            {
-              name: 'q',
-              in: 'query',
-              description: 'Le nom du plugin à rechercher.',
-              schema: {
-                type: 'string',
-                title: 'Nom du plugin à rechercher'
-              }
-            },
-            {
-              name: 'showAll',
-              in: 'query',
-              description: 'Afficher tous les plugins disponibles (même ceux en version bêta). La requête peut prendre plus de temps.',
-              schema: {
-                type: 'boolean',
-                title: 'Afficher tous les plugins disponibles'
-              }
-            }
-          ],
-          responses: {
-            200: {
-              description: 'La liste des plugins disponibles',
-              content: {
-                'application/json': {
-                  schema: {
-                    type: 'object',
-                    properties: {
-                      count: {
-                        type: 'integer',
-                        description: 'Le nombre de plugins trouvés.'
-                      },
-                      results: {
-                        type: 'array',
-                        items: {
-                          type: 'object',
-                          properties: {
-                            name: {
-                              type: 'string',
-                              description: 'Le nom du plugin.'
-                            },
-                            description: {
-                              type: 'string',
-                              description: 'La description du plugin.'
-                            },
-                            version: {
-                              type: 'string',
-                              description: 'La version du plugin.'
-                            },
-                            distTag: {
-                              type: 'string',
-                              description: 'Le tag de distribution du plugin.',
-                              example: 'latest'
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            },
-            400: {
-              description: 'Requête invalide, le paramètre "q" est mal formaté.'
-            },
-            429: {
-              description: 'Erreur renvoyée par l\'API NPM, trop de requêtes envoyées.'
-            },
-            500: {
-              description: 'Erreur interne (Il se peut que le service NPM soit indisponible).'
-            }
-          }
-        }
-      },
-      '/plugins': {
-        get: {
-          summary: 'Obtenir la liste des plugins installés',
-          description: 'Accéder à la liste des plugins installés.',
-          operationId: 'getPlugins',
-          tags: ['Plugins'],
-          parameters: [
-            {
-              name: 'privateAccess',
-              in: 'query',
-              description: 'Filtre par accès',
-              schema: {
-                type: 'string',
-                title: 'Filtre par accès',
-                example: 'type:id'
-              }
-            }
-          ],
-          responses: {
-            200: {
-              description: 'La liste des plugins installés',
-              content: {
-                'application/json': {
-                  schema: {
-                    count: {
-                      type: 'integer',
-                      description: 'Le nombre de plugins trouvés.'
-                    },
-                    facets: {
-                      type: 'object',
-                      properties: {
-                        usages: {
-                          type: 'object',
-                          additionalProperties: {
-                            type: 'integer',
-                            description: 'Le nombre de fois que le plugin est utilisé'
-                          }
-                        }
-                      }
-                    },
-                    results: {
-                      type: 'array',
-                      items: PluginSchema
-                    }
-                  }
-                }
-              }
-            },
-            400: {
-              description: 'Le paramètre "privateAccess" est manquant et l\'utilisateur n\'est pas super administrateur.'
-            },
-            403: {
-              description: 'Le privateAccess ne correspond pas avec l\'utilisateur authentifié.'
-            }
-          }
-        },
-        post: {
-          summary: 'Installer un plugin',
-          description: 'Installer/Mettre à jour un plugin, voir même baisser en version un plugin. Cette requête prends beaucoup de temps à s\'executer, c\'est le temps que le plugin s\'installe sur le serveur.',
-          operationId: 'postPlugin',
-          tags: ['Plugins'],
-          requestBody: {
-            description: 'Le plugin à installer',
-            required: true,
-            content: {
-              'application/json': {
-                schema: jsonSchema(PluginSchema)
-                  .pickProperties(['distTag', 'name', 'version', 'description'])
-                  .removeFromRequired(['description'])
-                  .removeId()
-                  .appendTitle(' post')
-                  .schema,
-                example: {
-                  name: '@data-fair/processing-export-file',
-                  description: 'Export File',
-                  version: '0.6.2',
-                  distTag: 'latest'
-                }
-              }
-            }
-          },
-          responses: {
-            200: {
-              description: 'Le plugin a été installé avec succès.',
-              content: {
-                'application/json': {
-                  schema: PluginSchema
-                }
-              }
-            }
-          }
-        }
-      },
-      '/plugins/{id}': {
-        parameters: [
-          {
-            name: 'id',
-            in: 'path',
-            required: true,
-            description: 'L\'identifiant du plugin.',
-            schema: {
-              type: 'string',
-              title: 'Identifiant du plugin'
-            }
-          }
-        ],
-        get: {
-          summary: 'Lire les informations d\'un plugin',
-          description: 'Accéder aux données d\'un plugin.',
-          operationId: 'getPlugin',
-          tags: ['Plugins'],
-          responses: {
-            200: {
-              description: 'Le plugin trouvé.',
-              content: {
-                'application/json': {
-                  schema: PluginSchema
-                }
-              }
-            },
-            404: {
-              description: 'Plugin non trouvé.'
-            }
-          }
-        },
-        delete: {
-          summary: 'Supprimer un plugin',
-          description: 'Supprimer un plugin.',
-          operationId: 'deletePlugin',
-          tags: ['Plugins'],
-          responses: {
-            204: {
-              description: 'Le plugin a été supprimé avec succès.'
-            }
-          }
-        },
-      },
-      '/plugins/{id}/config': {
-        parameters: [
-          {
-            name: 'id',
-            in: 'path',
-            required: true,
-            description: 'L\'identifiant du plugin.',
-            schema: {
-              type: 'string',
-              title: 'Identifiant du plugin'
-            }
-          }
-        ],
-        put: {
-          summary: 'Mettre à jour la configuration d\'un plugin',
-          description: 'Mettre à jour la configuration d\'un plugin.',
-          operationId: 'putPluginConfig',
-          tags: ['Plugins'],
-          requestBody: {
-            description: 'La configuration du plugin',
-            required: true,
-            content: {
-              'application/json': {
-                schema: {
-                  type: 'object'
-                }
-              }
-            }
-          },
-        }
-      },
-      '/plugins/{id}/metadata': {
-        parameters: [
-          {
-            name: 'id',
-            in: 'path',
-            required: true,
-            description: 'L\'identifiant du plugin.',
-            schema: {
-              type: 'string',
-              title: 'Identifiant du plugin'
-            }
-          }
-        ],
-        put: {
-          summary: 'Mettre à jour les métadonnées d\'un plugin',
-          description: 'Mettre à jour les métadonnées d\'un plugin.',
-          operationId: 'putPluginMetadata',
-          tags: ['Plugins'],
-          requestBody: {
-            description: 'Les métadonnées du plugin',
-            required: true,
-            content: {
-              'application/json': {
-                schema: {
-                  type: 'object'
-                }
-              }
-            }
-          },
-        }
-      },
-      '/plugins/{id}/access': {
-        parameters: [
-          {
-            name: 'id',
-            in: 'path',
-            required: true,
-            description: 'L\'identifiant du plugin.',
-            schema: {
-              type: 'string',
-              title: 'Identifiant du plugin'
-            }
-          }
-        ],
-        put: {
-          summary: 'Mettre à jour les accès d\'un plugin',
-          description: 'Mettre à jour les accès d\'un plugin.',
-          operationId: 'putPluginAccess',
-          tags: ['Plugins'],
-          requestBody: {
-            description: 'les accès du plugin',
-            required: true,
-            content: {
-              'application/json': {
-                schema: {
-                  type: 'object'
-                }
-              }
-            }
-          },
-        }
-      }
     }
   }
 
diff --git a/api/src/plugins-registry/router.ts b/api/src/plugins-registry/router.ts
deleted file mode 100644
index 57ac6b80..00000000
--- a/api/src/plugins-registry/router.ts
+++ /dev/null
@@ -1,75 +0,0 @@
-import type { AxiosRequestConfig } from 'axios'
-import { Router } from 'express'
-import memoize from 'memoizee'
-
-import { httpError } from '@data-fair/lib-utils/http-errors.js'
-import axios from '@data-fair/lib-node/axios.js'
-import config from '#config'
-
-const router = Router()
-export default router
-
-const axiosOpts: AxiosRequestConfig = {}
-
-if (config.npm?.httpsProxy) {
-  const proxyUrl = new URL(config.npm?.httpsProxy)
-  // cf https://axios-http.com/docs/req_config
-  axiosOpts.proxy = {
-    protocol: proxyUrl.protocol,
-    host: proxyUrl.hostname,
-    port: proxyUrl.port ? Number(proxyUrl.port) : (proxyUrl.protocol === 'https:' ? 443 : 80)
-  }
-  if (proxyUrl.username) axiosOpts.proxy.auth = { username: proxyUrl.username, password: proxyUrl.password }
-}
-
-/**
- * Search for plugins in the npm registry
- * @param q - search query
- * @param showAll - if true, return all versions of each plugin
- */
-const search = async (q: string | undefined, showAll: boolean) => {
-  // see https://github.com/npm/registry/blob/master/docs/REGISTRY-API.md#get-v1search
-  let res
-  try {
-    res = await axios.get('https://registry.npmjs.org/-/v1/search', {
-      ...axiosOpts,
-      params: {
-        size: 250,
-        text: `keywords:data-fair-processings-plugin ${q || ''}`
-      }
-    })
-  } catch (error: any) {
-    if (error.status === 429) throw httpError(429, 'Too many requests to NPM registry')
-    throw error
-  }
-
-  const results = []
-  for (const o of res.data.objects) {
-    if (!o.package.keywords || !o.package.keywords.includes('data-fair-processings-plugin')) continue
-    const plugin = { name: o.package.name, description: o.package.description, version: o.package.version }
-
-    if (showAll) {
-      const distTags = (await axios.get('https://registry.npmjs.org/-/package/' + o.package.name + '/dist-tags', axiosOpts)).data
-      for (const distTag in distTags) {
-        results.push({ ...plugin, version: distTags[distTag], distTag })
-      }
-    } else {
-      results.push({ ...plugin, distTag: 'latest' })
-    }
-  }
-  return {
-    count: results.length,
-    results
-  }
-}
-const memoizedSearch = memoize(search, {
-  maxAge: 5 * 60 * 1000 // cached for 5 minutes to be polite with npmjs
-})
-
-router.get('/', async (req, res) => {
-  if (req.query.q && typeof req.query.q !== 'string') {
-    res.status(400).send('Invalid query')
-    return
-  }
-  res.send(await memoizedSearch(req.query.q, req.query.showAll === 'true' || false))
-})
diff --git a/api/src/plugins/router.ts b/api/src/plugins/router.ts
deleted file mode 100644
index c71deb35..00000000
--- a/api/src/plugins/router.ts
+++ /dev/null
@@ -1,308 +0,0 @@
-import type { Plugin } from '#types/plugin/index.ts'
-
-import { exec } from 'child_process'
-import { promisify } from 'util'
-import { Router } from 'express'
-import Ajv from 'ajv'
-import ajvFormats from 'ajv-formats'
-import fs from 'fs-extra'
-import path from 'path'
-import semver from 'semver'
-import resolvePath from 'resolve-path'
-import tmp from 'tmp-promise'
-import multer from 'multer'
-
-import { session, httpError } from '@data-fair/lib-express'
-import mongo from '#mongo'
-import config from '#config'
-import permissions from '../misc/utils/permissions.ts'
-
-// @ts-ignore
-const ajv = ajvFormats(new Ajv({ strict: false }))
-const execAsync = promisify(exec)
-
-const router = Router()
-export default router
-
-const pluginsDir = path.resolve(config.dataDir, 'plugins')
-fs.ensureDirSync(pluginsDir)
-const tmpDir = config.tmpDir || path.resolve(config.dataDir, 'tmp')
-fs.ensureDirSync(tmpDir)
-
-tmp.setGracefulCleanup()
-
-/**
- * Multer configuration for handling file uploads.
- * It stores files directly in the temporary directory and only allows .tgz files.
- */
-const upload = multer({
-  storage: multer.diskStorage({
-    destination: (req, file, cb) => {
-      cb(null, tmpDir)
-    },
-    filename: (req, file, cb) => {
-      cb(null, `plugin-${Date.now()}-${file.originalname}`)
-    }
-  }),
-  fileFilter: (req, file, cb) => {
-    if (path.extname(file.originalname) === '.tgz') cb(null, true)
-    else cb(httpError(400, 'Only .tgz files are allowed'))
-  },
-  limits: { fileSize: 1 * 1024 * 1024 } // 1MB max
-})
-
-const pluginMetadataSchema = {
-  type: 'object',
-  additionalProperties: false,
-  properties: {
-    name: {
-      type: 'string',
-      title: 'Nom du plugin',
-      layout: {
-        cols: 4
-      }
-    },
-    category: {
-      type: 'string',
-      title: 'Catégorie',
-      enum: config.pluginCategories,
-      layout: {
-        cols: 4
-      }
-    },
-    icon: {
-      type: 'object',
-      title: 'Icon',
-      layout: {
-        getItems: {
-          url: 'https://koumoul.com/data-fair/api/v1/datasets/icons-mdi-latest/lines?q={q}&select=name,svg,svgPath&size=25',
-          itemsResults: 'data.results',
-          itemTitle: 'item.name',
-          itemIcon: 'item.svg',
-          itemKey: 'item.name'
-        },
-        cols: 4
-      }
-    },
-    documentation: {
-      type: 'string',
-      title: 'Documentation',
-      description: 'URL de la page du tutoriel du plugin',
-      format: 'uri',
-      errorMessage: 'Dois être une URL valide',
-    },
-    description: {
-      type: 'string',
-      title: 'Description du plugin'
-    }
-  }
-}
-
-// Install a new plugin or update an existing one
-router.post('/', upload.single('file'), permissions.isSuperAdmin, async (req, res) => {
-  const dir = await tmp.dir({ unsafeCleanup: true, tmpdir: tmpDir, prefix: 'plugin-install-' })
-  let id: string
-  let tarballPath: string
-  let plugin: Partial<Plugin>
-
-  try {
-    let distTag = 'latest'
-    if (req.file) { // File upload mode - use the uploaded .tgz file
-      tarballPath = req.file.path
-    } else { // NPM mode - validate body and download from npm
-      const { body } = (await import('#doc/plugin/post-req/index.ts')).returnValid(req)
-
-      // download the plugin package using npm pack
-      const { stdout } = await execAsync(`npm pack ${body.name}@${body.version}`, { cwd: dir.path })
-      tarballPath = path.join(dir.path, stdout.trim())
-      if (body.distTag !== 'latest') distTag = body.distTag
-    }
-
-    // extract the tarball
-    await execAsync(`tar -xzf "${tarballPath}" -C "${dir.path}"`)
-    const extractedPath = path.join(dir.path, 'package')
-
-    // install dependencies of the plugin
-    await execAsync('npm install --omit=dev', { cwd: extractedPath })
-
-    // generate plugin.json from package.json
-    const packageJson = await fs.readJson(path.join(extractedPath, 'package.json'))
-    id = packageJson.name.replace('/', '-') + '-' + semver.major(packageJson.version)
-    if (distTag !== 'latest') id += '-' + distTag
-
-    plugin = {
-      id,
-      name: packageJson.name,
-      description: packageJson.description,
-      version: packageJson.version,
-      distTag
-    }
-
-    // read plugin schemas
-    plugin.pluginConfigSchema = await fs.readJson(path.join(extractedPath, 'plugin-config-schema.json'))
-    plugin.processingConfigSchema = await fs.readJson(path.join(extractedPath, 'processing-config-schema.json'))
-
-    // static metadata for the plugin
-    await fs.writeFile(
-      path.join(extractedPath, 'plugin.json'),
-      JSON.stringify(plugin, null, 2)
-    )
-
-    // Create index.js if it doesn't exist and redirects to the main file
-    if (!await fs.pathExists(path.join(extractedPath, 'index.js'))) {
-      await fs.writeFile(path.join(extractedPath, 'index.js'), `export * from './${packageJson.main}'`)
-    }
-
-    // move the extracted plugin to the final destination
-    await fs.move(extractedPath, path.join(pluginsDir, id), { overwrite: true })
-    await dir.cleanup()
-    if (req.file) await fs.remove(req.file.path)
-  } catch (error: any) {
-    await dir.cleanup()
-    if (req.file) await fs.remove(req.file.path)
-    throw httpError(400, `Failed to install plugin: ${error.message || error}`)
-  }
-
-  // set defaults access (don't overwrite if already exists (after an update))
-  plugin.access = { public: false, privateAccess: [] }
-  const accessFilePath = path.join(pluginsDir, plugin.id + '-access.json')
-  if (!await fs.pathExists(accessFilePath)) await fs.writeJson(accessFilePath, plugin.access)
-
-  // return the existing config if it exists
-  const pluginConfigPath = path.join(pluginsDir, plugin.id + '-config.json')
-  if (await fs.pathExists(pluginConfigPath)) plugin.config = await fs.readJson(pluginConfigPath)
-
-  // return the existing metadata if it exists
-  const pluginMetadataPath = path.join(pluginsDir, plugin.id + '-metadata.json')
-  if (await fs.pathExists(pluginMetadataPath)) plugin.metadata = await fs.readJson(pluginMetadataPath)
-
-  res.send(plugin)
-})
-
-// List installed plugins (optional: privateAccess=[type]:[id])
-router.get('/', async (req, res) => {
-  const sessionState = await session.reqAuthenticated(req)
-
-  const dirs = (await fs.readdir(pluginsDir)).filter(p => !p.endsWith('.json'))
-  const results: Plugin[] = []
-  for (const dir of dirs) {
-    const pluginInfo: Plugin = await fs.readJson(path.join(pluginsDir, dir, 'plugin.json'))
-
-    let access = { public: false, privateAccess: [] }
-    const accessFilePath = path.join(pluginsDir, dir + '-access.json')
-    if (await fs.pathExists(accessFilePath)) {
-      access = await fs.readJson(path.join(pluginsDir, dir + '-access.json'))
-    }
-
-    if (sessionState.user.adminMode) {
-      const pluginConfigPath = path.join(pluginsDir, dir + '-config.json')
-      if (await fs.pathExists(pluginConfigPath)) pluginInfo.config = await fs.readJson(pluginConfigPath)
-      pluginInfo.access = access
-    } else if (req.query.privateAccess && typeof req.query.privateAccess === 'string') {
-      const [type, id] = req.query.privateAccess.split(':')
-      if (type !== sessionState.account.type || id !== sessionState.account.id) {
-        throw httpError(403, 'privateAccess does not match current account')
-      }
-      if (!access.public && !access.privateAccess.find((p: any) => p.type === type && p.id === id)) {
-        continue // pass to next plugin
-      }
-    } else {
-      throw httpError(400, 'privateAccess filter is required')
-    }
-
-    const pluginMetadataPath = path.join(pluginsDir, dir + '-metadata.json')
-    const version = pluginInfo.distTag === 'latest' ? pluginInfo.version : `${pluginInfo.distTag} - ${pluginInfo.version}`
-    pluginInfo.metadata = {
-      name: pluginInfo.name.replace('@data-fair/processing-', '') + ' (' + version + ')',
-      description: pluginInfo.description,
-      ...(await fs.pathExists(pluginMetadataPath) ? await fs.readJson(pluginMetadataPath) : {})
-    }
-    pluginInfo.pluginMetadataSchema = pluginMetadataSchema
-
-    results.push(pluginInfo)
-  }
-
-  const aggregationResult = (
-    await mongo.processings
-      .aggregate([{ $group: { _id: '$plugin', count: { $sum: 1 } } }])
-      .toArray()
-  ).reduce((acc:any, { _id, count }: any) => {
-    acc[_id] = count
-    return acc
-  }, {})
-
-  res.send({
-    count: results.length,
-    results,
-    facets: { usages: aggregationResult || {} }
-  })
-})
-
-// Return PluginData (if connected)
-router.get('/:id', async (req, res) => {
-  await session.reqAuthenticated(req)
-  try {
-    const pluginInfo: Plugin = await fs.readJson(resolvePath(pluginsDir, path.join(req.params.id, 'plugin.json')))
-    const pluginMetadataPath = path.join(pluginsDir, req.params.id + '-metadata.json')
-    const version = pluginInfo.distTag === 'latest' ? pluginInfo.version : `${pluginInfo.distTag} - ${pluginInfo.version}`
-    pluginInfo.metadata = {
-      name: pluginInfo.name.replace('@data-fair/processing-', '') + ' (' + version + ')',
-      description: pluginInfo.description,
-      ...(await fs.pathExists(pluginMetadataPath) ? await fs.readJson(pluginMetadataPath) : {})
-    }
-    res.send(pluginInfo)
-  } catch (e: any) {
-    if (e.code === 'ENOENT') res.status(404).send('Plugin not found')
-    else throw e
-  }
-})
-
-router.delete('/:id', permissions.isSuperAdmin, async (req, res) => {
-  const id = req.params.id as string
-  if (!id) throw httpError(400, 'Plugin ID is required')
-  if (!fs.existsSync(path.join(pluginsDir, id))) throw httpError(404, 'Plugin not found')
-
-  await fs.remove(path.join(pluginsDir, id))
-  await fs.remove(path.join(pluginsDir, id + '-config.json'))
-  await fs.remove(path.join(pluginsDir, id + '-access.json'))
-  await fs.remove(path.join(pluginsDir, id + '-metadata.json'))
-  res.status(204).send()
-})
-
-router.put('/:id/config', permissions.isSuperAdmin, async (req, res) => {
-  const id = req.params.id as string
-  const pluginPath = path.join(pluginsDir, id, 'plugin.json')
-  if (!await fs.pathExists(pluginPath)) {
-    throw httpError(404, 'Plugin not found')
-  }
-
-  const { pluginConfigSchema } = await fs.readJson(pluginPath)
-  const validate = ajv.compile(pluginConfigSchema)
-  const valid = validate(req.body)
-  if (!valid) return res.status(400).send(validate.errors)
-  await fs.writeJson(path.join(pluginsDir, id + '-config.json'), req.body)
-  res.send(req.body)
-})
-
-router.put('/:id/metadata', permissions.isSuperAdmin, async (req, res) => {
-  const id = req.params.id as string
-  if (!await fs.pathExists(path.join(pluginsDir, id, 'plugin.json'))) {
-    throw httpError(404, 'Plugin not found')
-  }
-
-  const validate = ajv.compile(pluginMetadataSchema)
-  const valid = validate(req.body)
-  if (!valid) return res.status(400).send(validate.errors)
-  await fs.writeJson(path.join(pluginsDir, id + '-metadata.json'), req.body)
-  res.send(req.body)
-})
-
-router.put('/:id/access', permissions.isSuperAdmin, async (req, res) => {
-  const id = req.params.id as string
-  if (!await fs.pathExists(path.join(pluginsDir, id, 'plugin.json'))) {
-    throw httpError(404, 'Plugin not found')
-  }
-
-  await fs.writeJson(path.join(pluginsDir, id + '-access.json'), req.body)
-  res.send(req.body)
-})
diff --git a/api/src/processings/router.ts b/api/src/processings/router.ts
index 1a4daf6a..7b6065fa 100644
--- a/api/src/processings/router.ts
+++ b/api/src/processings/router.ts
@@ -8,17 +8,18 @@ import cryptoRandomString from 'crypto-random-string'
 import { Router } from 'express'
 import fs from 'fs-extra'
 import path from 'path'
-import resolvePath from 'resolve-path'
 import { nanoid } from 'nanoid'
 
 import eventsQueue from '@data-fair/lib-node/events-queue.js'
 import { reqOrigin, session } from '@data-fair/lib-express/index.js'
+import { ensureArtefact } from '@data-fair/lib-node-registry'
 import { httpError } from '@data-fair/lib-utils/http-errors.js'
 import { createNext } from '@data-fair/processings-shared/runs.ts'
+import { importPluginModule } from '@data-fair/processings-shared/plugin-load.ts'
 import { applyProcessing, deleteProcessing } from '../runs/service.ts'
 import { cipher, decipher } from '@data-fair/processings-shared/cipher.ts'
 import mongo from '#mongo'
-import config from '#config'
+import config, { registryCacheDir } from '#config'
 import locks from '#locks'
 import { resolvedSchema as processingSchema } from '#types/processing/index.ts'
 import getApiDoc from '../misc/utils/api-docs.ts'
@@ -30,7 +31,40 @@ export default router
 
 // @ts-ignore
 const ajv = ajvFormats(new Ajv({ strict: false }))
-const pluginsDir = path.join(config.dataDir, 'plugins')
+
+/**
+ * Ensure the plugin tarball is in the API's local cache (downloads on miss).
+ * Registry enforces that `processing.owner` has access to the artefact; a 403
+ * here surfaces directly to the caller.
+ *
+ * The plugin's processing config schema is read from the conventional
+ * `processing-config-schema.json` shipped alongside the plugin (same convention
+ * as v5). Returns `undefined` when the plugin doesn't ship one.
+ */
+async function ensurePluginAndReadSchema (processing: Pick<Processing, 'plugin' | 'owner'>) {
+  const account = {
+    type: processing.owner.type,
+    id: processing.owner.id,
+    ...(processing.owner.department ? { department: processing.owner.department } : {})
+  }
+  // `processing.plugin` is the registry artefact id, passed through as-is.
+  // lib-node downloads + extracts the tarball into registryCacheDir on cache
+  // miss; the cache is invalidated when the artefact's dataUpdatedAt bumps.
+  const ensured = await ensureArtefact({
+    registryUrl: config.privateRegistryUrl,
+    secretKey: config.secretKeys.registry,
+    artefactId: processing.plugin,
+    cacheDir: registryCacheDir,
+    architecture: process.arch,
+    account
+  })
+  const schemaPath = path.join(ensured.path, 'processing-config-schema.json')
+  let processingConfigSchema: Record<string, unknown> | undefined
+  if (await fs.pathExists(schemaPath)) {
+    processingConfigSchema = await fs.readJson(schemaPath)
+  }
+  return { ensured, processingConfigSchema }
+}
 
 const sensitiveParts = ['permissions', 'webhookKey', 'config']
 
@@ -62,26 +96,32 @@ const sendProcessingEvent = (
 }
 
 /**
- * Check that a processing object is valid
- * Check if the plugin exists
- * Check if the config is valid (only if the processing is activated)
- * Encrypt secrets if present
+ * Check that a processing object is valid:
+ * - run schema validation
+ * - require a config when active
+ * - validate the config against the plugin's processingConfigSchema (read
+ *   from the cached package.json#registry block, downloaded on cache miss)
+ *
+ * Errors from registry (404 unknown artefact, 403 owner has no access) bubble
+ * up as the corresponding HTTP errors and replace the explicit access check
+ * that used to live in the create/update endpoints.
  */
 async function validateFullProcessing (processing: any): Promise<Processing> {
   (await import('#types/processing/index.ts')).returnValid(processing)
   if (processing.active && !processing.config) throw httpError(400, 'Config is required for an active processing')
-  if (!await fs.pathExists(path.join(pluginsDir, processing.plugin))) throw httpError(400, 'Plugin not found')
   if (!processing.config) return processing // no config to validate
-  const pluginInfo = await fs.readJson(path.join(pluginsDir, processing.plugin, 'plugin.json'))
-  const configValidate = ajv.compile(pluginInfo.processingConfigSchema)
+  const { processingConfigSchema } = await ensurePluginAndReadSchema(processing)
+  if (!processingConfigSchema) throw httpError(400, 'plugin has no processingConfigSchema')
+  const configValidate = ajv.compile(processingConfigSchema)
   const configValid = configValidate(processing.config)
   if (!configValid) throw httpError(400, JSON.stringify(configValidate.errors))
   return processing
 }
 
 const prepareProcessing = async (processing: Processing) => {
-  // Get the plugin file and execute the prepare function if it exists
-  const plugin = await import(path.resolve(process.cwd(), pluginsDir, processing.plugin, 'index.js') + `?imported=${Date.now()}`)
+  // Get the plugin file and execute the prepare function if it exists.
+  const { ensured } = await ensurePluginAndReadSchema(processing)
+  const plugin = await importPluginModule<{ prepare?: PrepareFunction }>(ensured.path, { cacheBust: true })
   if (!(plugin.prepare && typeof plugin.prepare === 'function')) return
 
   // Decipher the actuals secrets if they are present
@@ -144,7 +184,7 @@ router.get('', async (req, res) => {
       ].filter(Boolean)
     })
   }
-  // Filter by plugins
+  // Filter by plugins (matches the registry artefact id stored on `plugin`)
   const plugins = params.plugins ? params.plugins.split(',') : []
   if (plugins.length > 0) {
     queryWithFilters.plugin = { $in: plugins }
@@ -297,17 +337,9 @@ router.post('', async (req, res) => {
     date: new Date().toISOString()
   }
 
-  const access = await fs.pathExists(resolvePath(pluginsDir, body.plugin + '-access.json')) ? await fs.readJson(resolvePath(pluginsDir, body.plugin + '-access.json')) : { public: false, privateAccess: [] }
-  if (sessionState.user.adminMode) {
-    // ok for super admins
-  } else if (access && access.public) {
-    // ok, this plugin is public
-  } else if (access && access.privateAccess && access.privateAccess.find((p: any) => p.type === body.owner.type && p.id === body.owner.id)) {
-    // ok, private access is granted
-  } else {
-    return res.status(403).send('Access denied to this plugin')
-  }
-
+  // Plugin access check is delegated to registry: validateFullProcessing
+  // calls ensureArtefact with owner=body.owner, and registry returns 403 if
+  // the artefact is private and the owner has no privateAccess entry.
   const processing = await validateFullProcessing(body)
   Object.assign(processing, await prepareProcessing(processing))
   await mongo.processings.insertOne(processing)
@@ -383,6 +415,22 @@ router.get('/:id', async (req, res) => {
   res.status(200).json(cleanProcessing(processing, sessionState))
 })
 
+// Get the plugin's processingConfigSchema for this processing's pinned major.
+// Registry only stores tarballs and ignores their inner shape; the schema
+// ships as `processing-config-schema.json` next to the plugin and is read
+// on demand from the API's local cache.
+router.get('/:id/plugin-config-schema', async (req, res, next) => {
+  try {
+    const sessionState = await session.reqAuthenticated(req)
+    const processing = await mongo.processings.findOne({ _id: req.params.id })
+    if (!processing) return res.status(404).send()
+    if (!['admin', 'exec', 'read'].includes(permissions.getUserResourceProfile(processing.owner, processing.permissions, sessionState) ?? '')) return res.status(403).send()
+    const { processingConfigSchema } = await ensurePluginAndReadSchema(processing)
+    if (!processingConfigSchema) return res.status(404).send()
+    res.status(200).json(processingConfigSchema)
+  } catch (err) { next(err) }
+})
+
 // Delete a processing
 router.delete('/:id', async (req, res) => {
   const sessionState = await session.reqAuthenticated(req)
@@ -432,11 +480,17 @@ router.post('/:id/_trigger', async (req, res) => {
 })
 
 // Get the API documentation of a processing
-router.get('/:id/api-docs.json', permissions.isSuperAdmin, async (req, res) => {
-  const processing = await mongo.processings.findOne({ _id: req.params.id })
-  if (!processing) return res.status(404).send()
-  const pluginPath = path.join(pluginsDir, processing.plugin, 'plugin.json')
-  if (!await fs.pathExists(pluginPath)) return res.status(404).send('Plugin not found')
-  const plugin = await fs.readJson(pluginPath)
-  res.json(getApiDoc(reqOrigin(req), { processing, plugin }))
+router.get('/:id/api-docs.json', permissions.isSuperAdmin, async (req, res, next) => {
+  try {
+    const processing = await mongo.processings.findOne({ _id: req.params.id })
+    if (!processing) return res.status(404).send()
+    const { ensured, processingConfigSchema } = await ensurePluginAndReadSchema(processing)
+    const pluginPkg = await fs.readJson(path.join(ensured.path, 'package.json'))
+    const plugin = {
+      name: pluginPkg.name,
+      version: pluginPkg.version,
+      processingConfigSchema
+    }
+    res.json(getApiDoc(reqOrigin(req), { processing, plugin }))
+  } catch (err) { next(err) }
 })
diff --git a/api/src/runs/service.ts b/api/src/runs/service.ts
index 1d9d2633..6c5e22a5 100644
--- a/api/src/runs/service.ts
+++ b/api/src/runs/service.ts
@@ -8,7 +8,7 @@ import path from 'path'
 import resolvePath from 'resolve-path'
 import locks from '#locks'
 
-const processingsDir = path.resolve(config.dataDir, 'processings')
+const processingsDir = path.resolve(config.dataDir ?? config.tmpDir, 'processings')
 
 /**
  * Stop all pending runs for a processing if it is deactivated
diff --git a/api/src/server.ts b/api/src/server.ts
index f2ab198f..f0401db6 100644
--- a/api/src/server.ts
+++ b/api/src/server.ts
@@ -26,7 +26,7 @@ server.keepAliveTimeout = (60 * 1000) + 1000
 server.headersTimeout = (60 * 1000) + 2000
 
 export const start = async () => {
-  if (!existsSync(config.dataDir) && process.env.NODE_ENV === 'production') {
+  if (config.dataDir && !existsSync(config.dataDir) && process.env.NODE_ENV === 'production') {
     throw new Error(`Data directory ${resolvePath(config.dataDir)} was not mounted`)
   }
   if (config.observer.active) await startObserver(config.observer.port)
diff --git a/api/types/index.ts b/api/types/index.ts
index 6eb18dc1..d7519002 100644
--- a/api/types/index.ts
+++ b/api/types/index.ts
@@ -2,7 +2,6 @@ import type { Account } from '@data-fair/lib-express'
 
 export type { Limit } from './limit/index.js'
 export type { Permission } from './permission/index.js'
-export type { Plugin } from './plugin/index.js'
 export type { Processing } from './processing/index.js'
 export type { Run } from './run/index.js'
 export type { Scheduling } from './scheduling/index.js'
diff --git a/api/types/plugin/index.ts b/api/types/plugin/index.ts
deleted file mode 100644
index f5d615bd..00000000
--- a/api/types/plugin/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export * from './.type/index.js'
diff --git a/api/types/plugin/schema.js b/api/types/plugin/schema.js
deleted file mode 100644
index 3037c28d..00000000
--- a/api/types/plugin/schema.js
+++ /dev/null
@@ -1,103 +0,0 @@
-export default {
-  $id: 'https://github.com/data-fair/processings/plugin',
-  'x-exports': [
-    'types',
-    'validate',
-    'resolvedSchema'
-  ],
-  title: 'plugin',
-  type: 'object',
-  additionalProperties: false,
-  required: [
-    'name',
-    'description',
-    'version',
-    'distTag',
-    'id',
-    'metadata',
-    'pluginConfigSchema',
-    'pluginMetadataSchema',
-    'processingConfigSchema'
-  ],
-  properties: {
-    name: {
-      type: 'string',
-    },
-    description: {
-      type: 'string'
-    },
-    version: {
-      type: 'string'
-    },
-    distTag: {
-      type: 'string'
-    },
-    id: {
-      type: 'string'
-    },
-    pluginConfigSchema: {
-      type: 'object',
-      description: 'Schema de configuration du plugin.',
-    },
-    pluginMetadataSchema: {
-      type: 'object',
-      description: 'Schema de configuration des metadata.'
-    },
-    processingConfigSchema: {
-      type: 'object',
-      description: 'Schema de configuration du traitement.'
-    },
-    config: {
-      type: 'object',
-      description: 'La configuration du plugin respectant le schema de configuration du plugin.',
-    },
-    access: {
-      type: 'object',
-      additionalProperties: false,
-      properties: {
-        public: {
-          type: 'boolean'
-        },
-        privateAccess: {
-          type: 'array',
-          items: {
-            type: 'object',
-            additionalProperties: false,
-            required: ['type', 'id'],
-            properties: {
-              type: {
-                type: 'string'
-              },
-              id: {
-                type: 'string'
-              }
-            }
-          }
-        }
-      }
-    },
-    metadata: {
-      type: 'object',
-      description: 'Les metadata du plugin respectant le schema de configuration des metadata.',
-      additionalProperties: false,
-      required: ['name', 'description', 'category', 'icon'],
-      properties: {
-        name: {
-          type: 'string'
-        },
-        description: {
-          type: 'string'
-        },
-        category: {
-          type: 'string'
-        },
-        icon: {
-          type: 'string'
-        },
-        documentation: {
-          type: 'string'
-        }
-      }
-    }
-  }
-}
diff --git a/api/types/processing/schema.js b/api/types/processing/schema.js
index b65c2ac3..8c7ef889 100644
--- a/api/types/processing/schema.js
+++ b/api/types/processing/schema.js
@@ -86,7 +86,8 @@ export default {
     },
     plugin: {
       type: 'string',
-      readOnly: true
+      readOnly: true,
+      description: 'Registry artefact id of the plugin (e.g. @data-fair-processing-hello-world-1).'
     },
     scheduling: {
       type: 'array',
diff --git a/dev/init-env.sh b/dev/init-env.sh
index 2cb380d1..da2a1946 100755
--- a/dev/init-env.sh
+++ b/dev/init-env.sh
@@ -26,4 +26,5 @@ SD_PORT=$((RANDOM_NB + 30))
 EVENTS_PORT=$((RANDOM_NB + 31))
 OAV_PORT=$((RANDOM_NB + 32))
 DF_PORT=$((RANDOM_NB + 33))
+REGISTRY_PORT=$((RANDOM_NB + 34))
 EOF
diff --git a/dev/resources/nginx.conf.template b/dev/resources/nginx.conf.template
index e29c20ca..11e093bd 100644
--- a/dev/resources/nginx.conf.template
+++ b/dev/resources/nginx.conf.template
@@ -66,4 +66,12 @@ server {
   location /events/ {
     proxy_pass http://localhost:${EVENTS_PORT}/;
   }
+
+  # No URI on proxy_pass: nginx forwards the original encoded request URI as-is
+  # so artefact ids like @data-fair%2Fprocessing-hello-world keep their %2F
+  # all the way to the express :name route. Registry expects the /registry
+  # prefix in the URL itself (PUBLIC_URL=...registry).
+  location /registry/ {
+    proxy_pass http://localhost:${REGISTRY_PORT};
+  }
 }
diff --git a/docker-compose.yml b/docker-compose.yml
index e3dfa046..0550524b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -18,6 +18,7 @@ services:
       - DF_PORT=${DF_PORT}
       - EVENTS_PORT=${EVENTS_PORT}
       - OAV_PORT=${OAV_PORT}
+      - REGISTRY_PORT=${REGISTRY_PORT}
     volumes:
       - ./dev/resources/nginx.conf.template:/etc/nginx/templates/default.conf.template:ro
 
@@ -106,6 +107,32 @@ services:
       - USE_SIMPLE_DIRECTORY=true
       - ALLOWED_URLS={"processings":"http://${DEV_HOST}:${NGINX_PORT1}/processings/api/v1/api-docs.json","processingsId":"http://${DEV_HOST}:${NGINX_PORT1}/processings/api/v1/processings/{id}/api-docs.json","processingsAdmin":"http://${DEV_HOST}:${NGINX_PORT1}/processings/api/v1/admin/api-docs.json"}
 
+  # registry-side dev container — same domain as processings under /registry
+  # so the UI can hit it directly with the SimpleDirectory session cookie.
+  registry:
+    profiles:
+      - dev
+    image: ghcr.io/data-fair/registry:feat-processings-integration
+    network_mode: host
+    depends_on:
+      - mongo
+      - simple-directory
+    environment:
+      - PORT=${REGISTRY_PORT}
+      - MONGO_URL=mongodb://localhost:${MONGO_PORT}/data-fair-registry
+      - PRIVATE_DIRECTORY_URL=http://localhost:${SD_PORT}
+      - PUBLIC_URL=http://${DEV_HOST}:${NGINX_PORT1}/registry
+      - SECRET_INTERNAL_SERVICES=secret-registry-internal
+      - CIPHER_PASSWORD=1234567890123456789012345678901234567890
+      - API_KEYS_SALT=1234567890123456789012345678901234567890
+      - OBSERVER_ACTIVE=false
+      - FILES_STORAGE=fs
+      # /tmp is world-writable in the registry image; the container runs as
+      # uid 1000 ("node") and can't write to a docker-managed volume on /app/data
+      # without an init step. Tarballs are throwaway in dev/test so we just keep
+      # them inside the container and drop the named volume.
+      - DATA_DIR=/tmp/registry-data
+
   #####
   # db and search engine
   #####
diff --git a/docs/architecture/v6-registry-integration.md b/docs/architecture/v6-registry-integration.md
new file mode 100644
index 00000000..a270c06d
--- /dev/null
+++ b/docs/architecture/v6-registry-integration.md
@@ -0,0 +1,333 @@
+# Processings v6.0 — registry integration
+
+## Context
+
+`@data-fair/processings` today stores plugin code on a persistent volume at `dataDir/plugins/{plugin-id}` and tracks per-plugin state in three sibling JSON files (`-access.json`, `-config.json`, `-metadata.json`). Installation goes through a superadmin-only `POST /api/v1/plugins` that runs `npm pack` + `npm install --omit=dev`. The API and worker both `import()` directly from the volume.
+
+We want to move plugin code, schemas, metadata and access fully into `@data-fair/registry` (sibling repo at `/home/alban/data-fair/registry`), so processings becomes stateless w.r.t. plugin content. The worker and API will use registry's `lib-node` to download plugin tarballs into a per-container ephemeral cache (k8s `emptyDir`) on demand.
+
+This is a major version (v6.0) and a transition release: the legacy plugins volume is still optionally mounted, but only as a *read-only* source for two things:
+
+1. The first-boot migration — it reads each plugin dir, re-tars it (with `node_modules`) and uploads to registry, plus pushes metadata and access-grants.
+2. Legacy plugin-config (the editable global per-instance plugin config) — the worker keeps reading `{id}-config.json` from the volume in v6.0 only. The concept is deprecated; new plugin versions must not depend on it. A future major (v7.0) drops both the volume mount and the read-only support.
+
+Registry is the single source of truth for plugin code, schemas, public/private flag, access-grants, metadata. Processings keeps *no* mongo collection mirroring plugin state.
+
+## Key decisions
+
+- Registry holds plugin code + schemas + metadata + access. Processings no longer has an "installed plugins" set.
+- Tarballs in registry are pre-installed (include prod `node_modules`) and tagged with the CPU architecture they were built for. lib-node extracts directly; no runtime npm install.
+- Architecture-aware retrieval is incomplete in registry today — must be finished. Resolver and tarball download accept an `architecture` query; lib-node detects `process.arch` and sends it; a tarball with no architecture acts as a noarch fallback.
+- Worker auth: `x-secret-key` plus `x-account` JSON header. Registry validates the secret AND enforces grants for the supplied account. Without `x-account`, today's full-bypass behaviour is preserved.
+- The `POST/GET/PUT/DELETE /api/v1/plugins` endpoints, the on-disk plugin dir at runtime, and the UI plugin admin page are dropped entirely. The UI's "create processing" plugin picker calls registry directly.
+- API still calls each plugin's `prepare(context)` hook on save — it uses lib-node to ensure the plugin into its own emptyDir cache, separate from the worker's cache.
+- distTag-suffixed legacy plugins (e.g. `foo-1-beta`): skip with warning at migration time. Registry has no distTag concept and mangling artefact names is rejected as ugly; operator handles them manually.
+- UI → registry: direct browser call. Registry is deployed on the same domain at the `/registry` path, so no CORS handling is needed; the SimpleDirectory session cookie is already valid for the registry origin.
+- Plugin schemas (`processingConfigSchema`) are read by processings from the cached plugin tarball's `processing-config-schema.json` file (same convention as v5 — every existing published plugin already ships this file). Registry remains a generic artefact store and doesn't need to know about the schema shape.
+- Documentation: add to registry artefact schema. Icon: convert mdi name to SVG and upload to artefact thumbnail.
+- URL config: only `privateRegistryUrl` (internal, used by API/worker server-to-server) is configurable. The UI assumes registry is mounted at `/registry` on the same domain as processings.
+- Orphan processings (legacy `processing.plugin` string with no matching plugin dir on volume) → migration fails fast. We don't want a half-migrated database.
+- Plugin picker UI in v6.0: flat list with search, no sub-categories. Revisit later.
+
+## Plan
+
+### A. Registry-side changes (`/home/alban/data-fair/registry`)
+
+#### A.1 Architecture-aware version resolution
+- `api/src/artefacts/service-pure.ts` — extend `resolveVersionQuery(artefactId, versionParam, architecture?)` to return `{ primaryFilter, fallbackFilter?, sort }`. When `architecture` is set, primary filter adds `{ architecture }`; fallback filter adds `{ architecture: { $exists: false } }`.
+- `api/src/artefacts/router.ts` — in `GET /artefacts/:id/versions/:version` and `GET /artefacts/:id/versions/:version/tarball`, read `req.query.architecture`, run `findOne(primary)` then `findOne(fallback)` if missing; return 404 if neither matches.
+- Note: when patch 5 exists only as `arm64` and patch 4 as both archs, an `x64` worker resolving `1.2` gets patch 4. That's "latest patch available on my arch", not "latest patch overall". Document explicitly.
+
+#### A.2 lib-node (`lib-node/index.ts`)
+- Add `architecture?: string` (default `process.arch`) and `account?: { type: 'user'|'organization', id: string, department?: string }` to `EnsureArtefactOpts`.
+- Pass `architecture` as query param on both the resolve call and the tarball call.
+- When `account` is set, send `x-account: JSON.stringify(account)` alongside `x-secret-key`.
+- Cache key includes architecture: `extractDir = join(artefactDir, ${resolvedVersion}${arch ? '_' + arch : ''})`. `.current-version.json` becomes `{ version, architecture? }` (additive, backwards-compatible).
+- Update `lib-node/index.d.ts` and JSDoc to describe noarch fallback semantics.
+
+#### A.3 Internal-secret + account context (`api/src/auth.ts` and `api/src/artefacts/router.ts`)
+- New helper `tryInternalSecretWithAccount(req)` — returns `null`, `{ account: null }` (full bypass), or `{ account }` (validated).
+- `x-account` parses to `{ type, id, department? }`; invalid JSON/type → 400.
+- Replace internal-secret usage in `GET /artefacts`, `GET /artefacts/:id`, the resolver, the tarball endpoint, and `GET /artefacts/:id/download`:
+  - `account === null` → preserve today's bypass (filter: `{}`).
+  - `account` present → call `artefactAccessFilterForAccount(account, { requireGrant: false })` and apply that filter.
+- `api/src/access.ts` — add `requireGrant` option to `artefactAccessFilterForAccount`. Internal-with-account flows pass `false` (an account can be enforced without holding a global grant, as long as the artefact is public or has explicit privateAccess for that account). Read-key flow keeps `requireGrant: true`.
+- `PATCH /artefacts/:id` and `POST /access-grants` — currently require `session.reqAdminMode(req)`. Extend both to also accept `x-secret-key` (same temporary internal-secret pattern as the upload endpoint). The migration in section D needs this.
+
+#### A.4 Documentation field on artefact schema
+- `api/types/artefact/schema.js` — add optional `documentation: { type: 'string', format: 'uri' }`.
+- Surface it in `GET /artefacts/:id` responses (no extra work — present-in-doc auto-passes through).
+- Optional follow-up: extract `documentation` from `package.json#registry.documentation` during upload (mirrors how `processingConfigSchema` is extracted today).
+
+#### A.5 Tests
+- `tests/features/artefacts/*.unit.spec.ts` — new cases for `resolveVersionQuery` arch primary/fallback.
+- `tests/features/artefacts/*.api.spec.ts`:
+  - resolves to arch-specific tarball when one exists
+  - falls back to noarch tarball when no arch match exists
+  - 404 if no arch match and no noarch
+  - download with `x-account` enforces that account's grants
+  - download without `x-account` preserves bypass
+  - `PATCH /artefacts/:id` works with `x-secret-key`
+
+### B. Processings — runtime (`/home/alban/data-fair/processings_feat-registry`)
+
+#### B.1 Config keys
+- `api/config/type/schema.json` and `worker/config/type/schema.json` — top-level `privateRegistryUrl` (required), `secretKeys.registry` (alongside other internal secrets). `dataDir` is optional (defaults to null) and, when set, implies the legacy plugins volume is mounted (no separate flag).
+- `api/config/default.mjs`, `worker/config/default.mjs` — sensible defaults. `tmpDir` defaults to `${dataDir}/tmp` if `dataDir` is set, else `${os.tmpdir()}/data-fair-processings`. The registry tarball cache is always derived as `${tmpDir}/registry-cache` (mount `tmpDir` as emptyDir in k8s if you want the cache ephemeral).
+- `api/config/custom-environment-variables.mjs`, `worker/config/custom-environment-variables.mjs` — env var names: `PRIVATE_REGISTRY_URL`, `SECRET_REGISTRY`, `DATA_DIR`, `TMP_DIR`.
+- `api/src/config.ts` — UI hits `/registry` directly (same-domain assumption), so `uiConfig` no longer carries a registry URL.
+
+#### B.2 Drop plugin admin
+Files to delete entirely:
+- `api/src/plugins/router.ts`
+- `api/src/plugins-registry/router.ts`
+- `api/types/plugin/`
+- `api/doc/plugin/` (if present)
+- `ui/src/pages/admin/plugins.vue` (and route entry)
+- `tests/features/plugins/install.api.spec.ts`
+- `tests/features/plugins/registry.api.spec.ts`
+
+Edits:
+- `api/src/app.ts` — remove the two `app.use('/api/v1/plugins-registry', ...)` and `app.use('/api/v1/plugins', ...)` mounts and their imports.
+- `ui/src/App.vue` (or wherever the admin nav is built) — drop the `/admin/plugins` link.
+- Search `grep -rn 'api/v1/plugins' api/ ui/` and remove every remaining reference.
+
+#### B.3 Worker — replace dynamic import (`worker/src/task/task.ts` ~ lines 88–134)
+Replace the on-disk plugin location block with:
+
+```ts
+import { ensureArtefact } from '@data-fair/registry/lib-node'
+
+const ensured = await ensureArtefact({
+  registryUrl: config.privateRegistryUrl,
+  secretKey: config.secretKeys.registry,
+  artefactId: `${processing.plugin.name}@${semver.major(processing.plugin.version)}`,
+  version: processing.plugin.version,
+  cacheDir: registryCacheDir,
+  architecture: process.arch,
+  account: processing.owner
+})
+
+let pluginConfig: Record<string, unknown> = {}
+if (config.dataDir) {
+  const legacyConfigPath = path.join(config.dataDir, 'plugins', legacyIdFor(processing.plugin) + '-config.json')
+  if (await fs.pathExists(legacyConfigPath)) pluginConfig = await fs.readJson(legacyConfigPath)
+}
+
+const pluginModule = await import(path.join(ensured.path, 'index.js'))
+```
+
+`legacyIdFor({name, version})` reproduces the v5 id (`name.replace('/', '-') + '-' + semver.major(version)`). It lives in a small util module used by the migration scripts and the legacy plugin-config lookup; deleted in v7.0.
+
+The rest of `task.ts` (cwd, processingConfig, secrets, axios, ws, log) stays unchanged.
+
+#### B.4 API — validation + prepare (`api/src/processings/router.ts`)
+
+Both validation and `prepare` share one path: `ensureArtefact` into `registryCacheDir`, then read `${ensured.path}/package.json#registry.processingConfigSchema` for ajv. Calls to registry use `x-secret-key` + `x-account: processing.owner`, so a 403 from `ensureArtefact` becomes a 403 from the save endpoint — replaces the explicit access check at L300–309.
+
+A small helper:
+
+```ts
+async function ensurePluginAndReadSchema(processing) {
+  const ensured = await ensureArtefact({
+    registryUrl: config.privateRegistryUrl,
+    secretKey: config.secretKeys.registry,
+    artefactId: `${processing.plugin.name}@${semver.major(processing.plugin.version)}`,
+    version: processing.plugin.version,
+    cacheDir: registryCacheDir,
+    architecture: process.arch,
+    account: processing.owner
+  })
+  const pkg = await fs.readJson(path.join(ensured.path, 'package.json'))
+  return { ensured, processingConfigSchema: pkg.registry?.processingConfigSchema }
+}
+```
+
+- `validateFullProcessing` calls `ensurePluginAndReadSchema`, runs ajv on `processing.config`. The cache means the second call within the same save (for `prepare`) doesn't redownload.
+- `prepareProcessing` reuses the `ensured` reference if already obtained, otherwise calls the helper. Then `import(path.join(ensured.path, 'index.js') + '?imported=' + Date.now())` (cache-busting because prepare may be invoked multiple times in the same process). Calls `plugin.prepare(context)` if exported.
+- `GET /api/v1/processings/{id}/api-docs.json` (router.ts ~L435) calls `ensurePluginAndReadSchema` and inlines the schema into the OpenAPI definition.
+
+#### B.5 Plugin-config legacy read
+Single read site, in worker `task.ts` (B.3). API never reads plugin-config. When `dataDir` is unset, `pluginConfig = {}`. Worker logs a one-line deprecation warning when injecting a non-empty `pluginConfig`, so we can monitor stragglers.
+
+#### B.6 `processing.plugin` schema change
+- `api/types/processing/schema.js` — change the `plugin` property:
+  ```js
+  plugin: {
+    type: 'object',
+    additionalProperties: false,
+    required: ['name', 'version'],
+    readOnly: true,
+    properties: {
+      name: { type: 'string' },
+      version: { type: 'string', description: 'Semver pin like "1", "1.2", or exact "1.2.3"' }
+    }
+  }
+  ```
+- Aggregations in `router.ts` that group by `$plugin` (~L189, ~L206) — switch to a denormalized helper `pluginId` field updated on every save (`${plugin.name}@${semver.major(plugin.version)}`), or use a `$concat` in the aggregation.
+- Mongo migration: see D.4.
+
+### C. UI changes
+
+#### C.1 Plugin picker
+`ui/src/pages/processings/new.vue` (or wherever the picker lives — `grep -rn 'plugins?privateAccess' ui/src`):
+
+```ts
+const installedPluginsFetch = useFetch<{ results: Artefact[], count: number }>(
+  `${$uiConfig.registryUrl}/api/v1/artefacts?category=processing&size=100`
+)
+```
+
+Field mapping when displaying / when constructing `processing.plugin`:
+- `plugin.metadata.name` ← `artefact.title?.fr ?? artefact.title?.en ?? artefact.name`
+- `plugin.metadata.icon` → fetch from `${$uiConfig.registryUrl}/api/v1/artefacts/${artefact._id}/thumbnail/${artefact.thumbnail.id}`
+- `processing.plugin` → `{ name: artefact.name, version: String(artefact.majorVersion) }`
+
+For v6.0, list plugins flat with a search box. No sub-categories.
+
+Same-domain deployment: registry sits on the same host at `/registry`, so the browser call to `/registry/api/v1/artefacts?...` is same-origin. No CORS configuration is required and the existing SimpleDirectory session cookie is naturally sent. The dev environment must mirror this — see E.1.
+
+#### C.2 Drop admin pages and nav
+- Delete `ui/src/pages/admin/plugins.vue` and matching route in `ui/src/router/`.
+- Drop the `/admin/plugins` nav entry.
+- Search `grep -rn 'plugins' ui/src/components/admin/ ui/src/App.vue ui/src/i18n/` and clean up.
+
+### D. First-boot migration (`upgrade/6.0.0/`)
+
+Lives in the existing upgrade-scripts framework — `worker/src/worker.ts` already calls `await upgradeScripts(mongo.db, locks, config.upgradeRoot)` at startup, which provides the mongo lock against multi-pod races. Three scripts, run in order:
+
+#### D.1 `01-publish-plugins-to-registry.ts`
+- If `dataDir/plugins` doesn't exist → log "no legacy volume, skipping" and return.
+- For each plugin dir (skip files matching `*.json`, skip distTag dirs ending `-{distTag}` where `distTag !== 'latest'` — log a warning and continue):
+  - Read `dataDir/plugins/{id}/plugin.json` → `{ name, version }`.
+  - Probe registry: `GET /api/v1/artefacts/${encodeURIComponent(name + '@' + semver.major(version))}/versions/${version}?architecture=${process.arch}`. If 200 → already published, skip.
+  - Re-tar the directory (with `node_modules`) using `tar.create({ gzip: true, cwd: dataDir/plugins, prefix: 'package/' }, [id])`.
+  - Multipart POST to `${registry.privateUrl}/api/v1/artefacts/${encodeURIComponent(name)}/versions` with `architecture=${process.arch}` and `x-secret-key`.
+  - On 409 (artefact origin set / mirrored from elsewhere): fail fast with an operator-actionable error.
+
+#### D.2 `02-push-metadata-and-access.ts`
+For each plugin dir:
+- Read `{id}-metadata.json` (if present) and `{id}-access.json` (if present, default `{public: false, privateAccess: []}`).
+- PATCH `${registry.privateUrl}/api/v1/artefacts/${encodeURIComponent(name + '@' + semver.major(version))}` with `x-secret-key`:
+  - `public: !!access.public`
+  - `privateAccess: access.privateAccess`
+  - `title: { fr: metadata.name }` if present
+  - `description: { fr: metadata.description }` if present (note: registry localised description; mapping to `fr` matches today's UI)
+  - `documentation: metadata.documentation` if present (registry artefact schema is being extended in A.4)
+- If `metadata.icon` is an mdi name string: render to SVG (use `@mdi/js` to fetch the path, wrap in an `<svg>` template) and POST it to the artefact's thumbnail endpoint. If the icon name is invalid, skip with warning.
+- For each `access.privateAccess` entry: `POST /api/v1/access-grants` with `{ account: acc }`. Accept 201 or 409 (already exists, idempotent).
+
+#### D.3 `03-rewrite-processing-plugin.ts`
+- Find `processings` where `plugin` is type string.
+- For each: parse `{id} = plugin`, find the matching legacy plugin dir, read its `plugin.json` to recover `name` and `version`, then `db.collection('processings').updateOne({_id}, { $set: { plugin: { name, version: String(semver.major(version)) }, pluginId: ... } })`.
+- If a processing's plugin id has no matching dir on the volume → fail-fast (throw). Operator must restore the volume or delete the orphaned processing manually.
+- If `dataDir` is unset AND there are any legacy-string processings → fail-fast at startup with a clear message ("set DATA_DIR and re-mount the plugins volume for the v6.0 boot").
+
+### E. Dev / test environment
+
+#### E.1 docker-compose
+Add to `docker-compose.yml`:
+
+```yaml
+registry:
+  profiles: [dev]
+  image: ghcr.io/data-fair/registry:main
+  network_mode: host
+  depends_on: [mongo, simple-directory]
+  environment:
+    - PORT=${REGISTRY_PORT}
+    - MONGO_URL=mongodb://localhost:${MONGO_PORT}/data-fair-registry
+    - PRIVATE_DIRECTORY_URL=http://localhost:${SD_PORT}
+    - PUBLIC_URL=http://${DEV_HOST}:${NGINX_PORT1}/registry
+    - SECRET_INTERNAL_SERVICES=secret-registry-internal
+    - OBSERVER_ACTIVE=false
+    - STORAGE_TYPE=fs
+  volumes:
+    - registry-data:/app/data
+
+volumes:
+  registry-data:
+```
+
+- Add `REGISTRY_PORT` to `dev/init-env.sh` and `.env`.
+- Add `/registry/` location in `dev/resources/nginx.conf.template` proxying to `localhost:${REGISTRY_PORT}`.
+- `api/config/development.mjs` and `worker/config/development.mjs` add a `registry` block with the dev URL/secret and `cacheDir: '../data/registry-cache'`.
+
+#### E.2 Test fixtures
+- New helper `tests/support/registry.ts` with `publishFixturePlugin(tgzPath, { architecture, public, privateAccess })` that POSTs to registry with `x-secret-key`.
+- In `tests/state-setup.ts`, after the existing `DELETE /api/v1/test-env` cleanup, add a registry cleanup endpoint call (or directly clear the registry's mongo `data-fair-registry` db).
+- `tests/fixtures/processing-hello-world.tgz` — kept and reused as the canonical fixture, published to registry by `publishFixturePlugin` in tests that need it.
+
+#### E.3 Tests that change
+- Delete `tests/features/plugins/install.api.spec.ts` and `tests/features/plugins/registry.api.spec.ts`.
+- `tests/features/processings/lifecycle.api.spec.ts` — every `processing.plugin` literal becomes `{ name, version }`. Setup pre-publishes the fixture plugin and grants access to the test org via `POST /api/v1/access-grants`.
+- `tests/features/processings/permissions.api.spec.ts` — same plugin-shape rewrite + ensure registry grants exist for the orgs each test exercises (or that the artefact is `public:true`).
+- New `tests/features/registry-integration/migration.api.spec.ts` — pre-seeds a `dataDir/plugins/...` fixture, runs the upgrade scripts, asserts the artefact + grants now exist in registry and the corresponding `processings` rows are rewritten.
+
+### F. Deprecation timeline
+- **v6.0** (this work): legacy plugins volume optional, read-only for plugin-config injection. First-boot migration runs idempotently. UI plugin admin gone. Registry is source of truth for everything else.
+- **v6.x patches**: monitor "deprecation: plugin used pluginConfig" warnings in worker logs; encourage plugin authors to publish updated versions that don't read it.
+- **v7.0**: drop `config.dataDir`, the `if (config.dataDir)` block in worker `task.ts`, the `legacyIdFor()` helper, the `upgrade/6.0.0/` scripts, and the volume mount in deploy manifests / docker-compose.
+
+## Critical files to change
+
+Registry (`/home/alban/data-fair/registry`):
+- `api/src/artefacts/service-pure.ts`
+- `api/src/artefacts/router.ts`
+- `api/src/auth.ts`
+- `api/src/access.ts`
+- `api/types/artefact/schema.js`
+- `lib-node/index.ts`, `lib-node/index.d.ts`
+
+Processings (`/home/alban/data-fair/processings_feat-registry`):
+- `worker/src/task/task.ts`
+- `api/src/processings/router.ts`
+- `api/src/app.ts`
+- `api/types/processing/schema.js`
+- `api/config/default.mjs`, `worker/config/default.mjs`, `*/config/custom-environment-variables.mjs`
+- `api/src/config.ts` (uiConfig)
+- `ui/src/pages/processings/new.vue` (or wherever the plugin picker is)
+- `docker-compose.yml`, `dev/init-env.sh`, `dev/resources/nginx.conf.template`
+- New: `upgrade/6.0.0/01-publish-plugins-to-registry.ts`, `02-push-metadata-and-access.ts`, `03-rewrite-processing-plugin.ts`
+- New: `tests/support/registry.ts`, `tests/features/registry-integration/migration.api.spec.ts`
+
+To delete:
+- `api/src/plugins/router.ts`, `api/src/plugins-registry/router.ts`, `api/types/plugin/`
+- `ui/src/pages/admin/plugins.vue`
+- `tests/features/plugins/install.api.spec.ts`, `tests/features/plugins/registry.api.spec.ts`
+
+## Verification
+
+### End-to-end manual test
+1. `docker compose --profile dev up -d` — brings up registry alongside processings, mongo, simple-directory.
+2. As superadmin in registry UI, create an upload API key.
+3. Build a self-contained plugin tarball (`npm pack` over a directory that already has `node_modules`) and `curl -F file=@plugin.tgz -F architecture=x64 -H 'x-api-key: ...' http://localhost/registry/api/v1/artefacts/@data-fair%2Fprocessing-hello-world/versions`.
+4. PATCH the artefact `public: true` (or grant access to `organization:test_org1`).
+5. As `test_admin1@test.com` in processings UI, navigate to `/processings/new` — registry plugin list renders.
+6. Pick the plugin, fill config, save → API runs `validateFullProcessing` (HTTP fetch) and `prepareProcessing` (lib-node download to API cache). Both succeed.
+7. Trigger a run. Worker downloads via lib-node into its own cache (`downloaded: true` first time, `false` on the next run).
+8. Smoke checks:
+   - Revoke org's grant in registry → next run fails with a clear 403 from `ensureArtefact`.
+   - Upload only `arm64` of a new version on an `x64` worker → 404. Re-upload without `architecture` → noarch fallback works on both arches.
+
+### Tests that must pass
+- `tests/features/processings/lifecycle.api.spec.ts` (rewritten)
+- `tests/features/processings/permissions.api.spec.ts` (rewritten)
+- New `tests/features/registry-integration/migration.api.spec.ts`
+- Registry: new arch-routing tests, x-account auth tests
+- Existing unit tests in `tests/features/worker-utils/`, `api-utils/`, `shared/` (not affected)
+
+### Smoke matrix
+| Scenario | Expected |
+|---|---|
+| Owner has grant, plugin public, arch matches | 200, run completes |
+| Owner has grant, plugin private with grant, arch matches | 200, run completes |
+| Owner has grant, plugin private without grant on this org | 403 from `ensureArtefact`, run fails with clear log |
+| x64 worker, only arm64 tarball exists | 404 |
+| x64 worker, arm64 + noarch tarballs exist | 200, downloads noarch |
+| Save with valid config | 200 |
+| Save with config violating `processingConfigSchema` | 400 |
+| First-boot migration on volume with 3 plugins | all 3 published once, idempotent on re-run |
+| First-boot with one plugin already in registry | skipped, no error |
+| Migration with orphan `processing.plugin` (dir missing) | startup fails fast with operator-actionable error |
+| Migration with distTag plugin dir | warning logged, processing referencing it left as legacy string until manually fixed |
diff --git a/package-lock.json b/package-lock.json
index c29efe79..df1b0711 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -46,6 +46,7 @@
       "dependencies": {
         "@data-fair/lib-express": "^1.22.5",
         "@data-fair/lib-node": "^2.12.1",
+        "@data-fair/lib-node-registry": "^0.4.0",
         "@data-fair/lib-utils": "^1.10.1",
         "@data-fair/processings-shared": "*",
         "ajv": "^8.17.1",
@@ -593,6 +594,21 @@
         }
       }
     },
+    "node_modules/@data-fair/lib-node-registry": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/@data-fair/lib-node-registry/-/lib-node-registry-0.4.0.tgz",
+      "integrity": "sha512-NUXZ11xoJvIWC5el7YQrnW9k9GcYIfRggxDlSUjUKMZLKCpLCIvNSmPkNZ+23+afKlL8faFn5oFtOrxyGA6tDg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/resolve-path": "^1.4.3",
+        "@types/tar-stream": "^3.1.4",
+        "resolve-path": "^1.4.0",
+        "tar-stream": "^3.1.0"
+      },
+      "peerDependencies": {
+        "@data-fair/lib-node": ">=2.8.0"
+      }
+    },
     "node_modules/@data-fair/lib-types-builder": {
       "version": "1.11.6",
       "resolved": "https://registry.npmjs.org/@data-fair/lib-types-builder/-/lib-types-builder-1.11.6.tgz",
@@ -1666,6 +1682,27 @@
         "vue": "^3.0.0"
       }
     },
+    "node_modules/@isaacs/fs-minipass": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
+      "integrity": "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==",
+      "license": "ISC",
+      "dependencies": {
+        "minipass": "^7.0.4"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@isaacs/fs-minipass/node_modules/minipass": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
     "node_modules/@jridgewell/gen-mapping": {
       "version": "0.3.13",
       "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
@@ -2743,7 +2780,6 @@
       "version": "1.4.3",
       "resolved": "https://registry.npmjs.org/@types/resolve-path/-/resolve-path-1.4.3.tgz",
       "integrity": "sha512-6mMvIPfQhbOOvntC6GbLqlEZP9fmkhqICNDbdCj2BbhaF7hoYuTiDiW63mOYtUQ9+E+b4ahyuqY1N0uVMxDH9w==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/semver": {
@@ -2773,6 +2809,26 @@
         "@types/node": "*"
       }
     },
+    "node_modules/@types/tar": {
+      "version": "6.1.13",
+      "resolved": "https://registry.npmjs.org/@types/tar/-/tar-6.1.13.tgz",
+      "integrity": "sha512-IznnlmU5f4WcGTh2ltRu/Ijpmk8wiWXfF0VA4s+HPjHZgvFggk1YaIkbo5krX/zUCzWF8N/l4+W/LNxnvAJ8nw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*",
+        "minipass": "^4.0.0"
+      }
+    },
+    "node_modules/@types/tar-stream": {
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/@types/tar-stream/-/tar-stream-3.1.4.tgz",
+      "integrity": "sha512-921gW0+g29mCJX0fRvqeHzBlE/XclDaAG0Ousy1LCghsOhvaKacDeRGEVzQP9IPfKn8Vysy7FEXAIxycpc/CMg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
     "node_modules/@types/web-bluetooth": {
       "version": "0.0.21",
       "resolved": "https://registry.npmjs.org/@types/web-bluetooth/-/web-bluetooth-0.0.21.tgz",
@@ -4046,12 +4102,117 @@
         "axios": "0.x || 1.x"
       }
     },
+    "node_modules/b4a": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/b4a/-/b4a-1.8.1.tgz",
+      "integrity": "sha512-aiqre1Nr0B/6DgE2N5vwTc+2/oQZ4Wh1t4NznYY4E00y8LCt6NqdRv81so00oo27D8MVKTpUa/MwUUtBLXCoDw==",
+      "license": "Apache-2.0",
+      "peerDependencies": {
+        "react-native-b4a": "*"
+      },
+      "peerDependenciesMeta": {
+        "react-native-b4a": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/balanced-match": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
       "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
       "license": "MIT"
     },
+    "node_modules/bare-events": {
+      "version": "2.8.2",
+      "resolved": "https://registry.npmjs.org/bare-events/-/bare-events-2.8.2.tgz",
+      "integrity": "sha512-riJjyv1/mHLIPX4RwiK+oW9/4c3TEUeORHKefKAKnZ5kyslbN+HXowtbaVEqt4IMUB7OXlfixcs6gsFeo/jhiQ==",
+      "license": "Apache-2.0",
+      "peerDependencies": {
+        "bare-abort-controller": "*"
+      },
+      "peerDependenciesMeta": {
+        "bare-abort-controller": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/bare-fs": {
+      "version": "4.7.1",
+      "resolved": "https://registry.npmjs.org/bare-fs/-/bare-fs-4.7.1.tgz",
+      "integrity": "sha512-WDRsyVN52eAx/lBamKD6uyw8H4228h/x0sGGGegOamM2cd7Pag88GfMQalobXI+HaEUxpCkbKQUDOQqt9wawRw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "bare-events": "^2.5.4",
+        "bare-path": "^3.0.0",
+        "bare-stream": "^2.6.4",
+        "bare-url": "^2.2.2",
+        "fast-fifo": "^1.3.2"
+      },
+      "engines": {
+        "bare": ">=1.16.0"
+      },
+      "peerDependencies": {
+        "bare-buffer": "*"
+      },
+      "peerDependenciesMeta": {
+        "bare-buffer": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/bare-os": {
+      "version": "3.9.1",
+      "resolved": "https://registry.npmjs.org/bare-os/-/bare-os-3.9.1.tgz",
+      "integrity": "sha512-6M5XjcnsygQNPMCMPXSK379xrJFiZ/AEMNBmFEmQW8d/789VQATvriyi5r0HYTL9TkQ26rn3kgdTG3aisbrXkQ==",
+      "license": "Apache-2.0",
+      "engines": {
+        "bare": ">=1.14.0"
+      }
+    },
+    "node_modules/bare-path": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/bare-path/-/bare-path-3.0.0.tgz",
+      "integrity": "sha512-tyfW2cQcB5NN8Saijrhqn0Zh7AnFNsnczRcuWODH0eYAXBsJ5gVxAUuNr7tsHSC6IZ77cA0SitzT+s47kot8Mw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "bare-os": "^3.0.1"
+      }
+    },
+    "node_modules/bare-stream": {
+      "version": "2.13.1",
+      "resolved": "https://registry.npmjs.org/bare-stream/-/bare-stream-2.13.1.tgz",
+      "integrity": "sha512-Vp0cnjYyrEC4whYTymQ+YZi6pBpfiICZO3cfRG8sy67ZNWe951urv1x4eW1BKNngw3U+3fPYb5JQvHbCtxH7Ow==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "streamx": "^2.25.0",
+        "teex": "^1.0.1"
+      },
+      "peerDependencies": {
+        "bare-abort-controller": "*",
+        "bare-buffer": "*",
+        "bare-events": "*"
+      },
+      "peerDependenciesMeta": {
+        "bare-abort-controller": {
+          "optional": true
+        },
+        "bare-buffer": {
+          "optional": true
+        },
+        "bare-events": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/bare-url": {
+      "version": "2.4.3",
+      "resolved": "https://registry.npmjs.org/bare-url/-/bare-url-2.4.3.tgz",
+      "integrity": "sha512-Kccpc7ACfXaxfeInfqKcZtW4pT5YBn1mesc4sCsun6sRwtbJ4h+sNOaksUpYEJUKfN65YWC6Bw2OJEFiKxq8nQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "bare-path": "^3.0.0"
+      }
+    },
     "node_modules/binary-extensions": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.3.0.tgz",
@@ -4283,6 +4444,15 @@
         "url": "https://paulmillr.com/funding/"
       }
     },
+    "node_modules/chownr": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
+      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/cliui": {
       "version": "8.0.1",
       "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
@@ -5768,6 +5938,15 @@
         "es5-ext": "~0.10.14"
       }
     },
+    "node_modules/events-universal": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/events-universal/-/events-universal-1.0.1.tgz",
+      "integrity": "sha512-LUd5euvbMLpwOF8m6ivPCbhQeSiYVNb8Vs0fQ8QjXo0JTkEHpz8pxdQf0gStltaPpw0Cca8b39KxvK9cfKRiAw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "bare-events": "^2.7.0"
+      }
+    },
     "node_modules/express": {
       "version": "5.2.1",
       "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
@@ -5857,6 +6036,12 @@
       "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
       "license": "MIT"
     },
+    "node_modules/fast-fifo": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/fast-fifo/-/fast-fifo-1.3.2.tgz",
+      "integrity": "sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==",
+      "license": "MIT"
+    },
     "node_modules/fast-glob": {
       "version": "3.3.3",
       "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.3.tgz",
@@ -8040,6 +8225,37 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/minipass": {
+      "version": "4.2.8",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-4.2.8.tgz",
+      "integrity": "sha512-fNzuVyifolSLFL4NzpF+wEF4qrgqaaKX0haXPQEdQ7NKAN+WecoKMHV09YcuL/DHxrUsYQOK3MiuDf7Ip2OXfQ==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/minizlib": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz",
+      "integrity": "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==",
+      "license": "MIT",
+      "dependencies": {
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/minizlib/node_modules/minipass": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
     "node_modules/mlly": {
       "version": "1.8.2",
       "resolved": "https://registry.npmjs.org/mlly/-/mlly-1.8.2.tgz",
@@ -10101,6 +10317,17 @@
         "node": ">=10.0.0"
       }
     },
+    "node_modules/streamx": {
+      "version": "2.25.0",
+      "resolved": "https://registry.npmjs.org/streamx/-/streamx-2.25.0.tgz",
+      "integrity": "sha512-0nQuG6jf1w+wddNEEXCF4nTg3LtufWINB5eFEN+5TNZW7KWJp6x87+JFL43vaAUPyCfH1wID+mNVyW6OHtFamg==",
+      "license": "MIT",
+      "dependencies": {
+        "events-universal": "^1.0.0",
+        "fast-fifo": "^1.3.2",
+        "text-decoder": "^1.1.0"
+      }
+    },
     "node_modules/string_decoder": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
@@ -10326,6 +10553,52 @@
         "url": "https://opencollective.com/webpack"
       }
     },
+    "node_modules/tar": {
+      "version": "7.5.13",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.13.tgz",
+      "integrity": "sha512-tOG/7GyXpFevhXVh8jOPJrmtRpOTsYqUIkVdVooZYJS/z8WhfQUX8RJILmeuJNinGAMSu1veBr4asSHFt5/hng==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "@isaacs/fs-minipass": "^4.0.0",
+        "chownr": "^3.0.0",
+        "minipass": "^7.1.2",
+        "minizlib": "^3.1.0",
+        "yallist": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tar-stream": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-3.2.0.tgz",
+      "integrity": "sha512-ojzvCvVaNp6aOTFmG7jaRD0meowIAuPc3cMMhSgKiVWws1GyHbGd/xvnyuRKcKlMpt3qvxx6r0hreCNITP9hIg==",
+      "license": "MIT",
+      "dependencies": {
+        "b4a": "^1.6.4",
+        "bare-fs": "^4.5.5",
+        "fast-fifo": "^1.2.0",
+        "streamx": "^2.15.0"
+      }
+    },
+    "node_modules/tar/node_modules/minipass": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
+    "node_modules/tar/node_modules/yallist": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
+      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/tdigest": {
       "version": "0.1.2",
       "resolved": "https://registry.npmjs.org/tdigest/-/tdigest-0.1.2.tgz",
@@ -10335,6 +10608,24 @@
         "bintrees": "1.0.2"
       }
     },
+    "node_modules/teex": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/teex/-/teex-1.0.1.tgz",
+      "integrity": "sha512-eYE6iEI62Ni1H8oIa7KlDU6uQBtqr4Eajni3wX7rpfXD8ysFx8z0+dri+KWEPWpBsxXfxu58x/0jvTVT1ekOSg==",
+      "license": "MIT",
+      "dependencies": {
+        "streamx": "^2.12.5"
+      }
+    },
+    "node_modules/text-decoder": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/text-decoder/-/text-decoder-1.2.7.tgz",
+      "integrity": "sha512-vlLytXkeP4xvEq2otHeJfSQIRyWxo/oZGEbXrtEEF9Hnmrdly59sUbzZ/QgyWuLYHctCHxFF4tRQZNQ9k60ExQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "b4a": "^1.6.4"
+      }
+    },
     "node_modules/timers-ext": {
       "version": "0.1.8",
       "resolved": "https://registry.npmjs.org/timers-ext/-/timers-ext-0.1.8.tgz",
@@ -11730,7 +12021,9 @@
     "worker": {
       "dependencies": {
         "@data-fair/lib-node": "^2.12.1",
+        "@data-fair/lib-node-registry": "^0.4.0",
         "@data-fair/processings-shared": "*",
+        "@mdi/js": "^7.4.47",
         "axios": "^1.8.3",
         "axios-retry": "^4.5.0",
         "config": "^4.4.1",
@@ -11739,13 +12032,18 @@
         "nodemailer": "^8.0.4",
         "prom-client": "^15.1.3",
         "resolve-path": "^1.4.0",
+        "semver": "^7.7.4",
+        "tar": "^7.5.1",
+        "tar-stream": "^3.1.0",
         "tmp-promise": "^3.0.3",
         "tree-kill": "^1.2.2"
       },
       "devDependencies": {
         "@data-fair/lib-express": "^1.22.5",
         "@types/nodemailer": "^6.4.16",
-        "@types/resolve-path": "^1.4.3"
+        "@types/resolve-path": "^1.4.3",
+        "@types/tar": "^6.1.13",
+        "@types/tar-stream": "^3.1.4"
       }
     }
   }
diff --git a/shared/plugin-load.ts b/shared/plugin-load.ts
new file mode 100644
index 00000000..6de25970
--- /dev/null
+++ b/shared/plugin-load.ts
@@ -0,0 +1,27 @@
+import path from 'node:path'
+import fs from 'fs-extra'
+
+/**
+ * Resolve a plugin's entry point from its package.json#main and dynamic-import it.
+ *
+ * Plugins can ship pre-built JS (main: "index.js") or rely on Node's built-in
+ * type-stripping (main: "index.ts"). Either way, callers should not hard-code
+ * an extension — read main and trust it.
+ *
+ * `cacheBust` appends a query string so the same module path can be re-imported
+ * fresh in the same process (used by the API's `prepare` flow, which may run
+ * twice in one save).
+ */
+export const importPluginModule = async <T = unknown>(
+  pluginDir: string,
+  opts: { cacheBust?: boolean } = {}
+): Promise<T> => {
+  const pkg = await fs.readJson(path.join(pluginDir, 'package.json'))
+  const mainRel = typeof pkg.main === 'string' && pkg.main.length > 0 ? pkg.main : 'index.js'
+  const mainAbs = path.resolve(pluginDir, mainRel)
+  if (!(await fs.pathExists(mainAbs))) {
+    throw new Error(`fichier source manquant : ${mainAbs}`)
+  }
+  const url = opts.cacheBust ? `${mainAbs}?imported=${Date.now()}` : mainAbs
+  return (await import(url)) as T
+}
diff --git a/tests/features/plugins/install.api.spec.ts b/tests/features/plugins/install.api.spec.ts
deleted file mode 100644
index 8261005b..00000000
--- a/tests/features/plugins/install.api.spec.ts
+++ /dev/null
@@ -1,137 +0,0 @@
-import { test, expect } from '@playwright/test'
-import { axios, axiosAuth, clean } from '../../support/axios.ts'
-
-const axAno = axios()
-
-const plugin = {
-  name: '@data-fair/processing-hello-world',
-  version: '1.2.2',
-  distTag: 'latest',
-}
-const pluginId = '@data-fair-processing-hello-world-1'
-
-test.describe('plugin', () => {
-  test.beforeAll(clean)
-  test.afterAll(clean)
-
-  test('should install a plugin from npm', async () => {
-    const superadmin = await axiosAuth('test_superadmin@test.com')
-    const adminTestOrg1 = await axiosAuth({ email: 'test_admin1@test.com', org: 'test_org1' })
-
-    const res = await superadmin.post('/api/v1/plugins', {
-      name: plugin.name,
-      version: '0.13.0', // Previous version to test update
-      distTag: 'latest'
-    })
-    expect(res.data.name).toBe(plugin.name)
-    expect(res.data.id).toBe('@data-fair-processing-hello-world-0')
-    expect(res.data.version).toBe('0.13.0')
-
-    // Only superadmin can install plugins
-    await expect(adminTestOrg1.post('/api/v1/plugins')).rejects.toMatchObject({ status: 403 })
-  })
-
-  test('should install a plugin from tarball', async () => {
-    const superadmin = await axiosAuth('test_superadmin@test.com')
-    const adminTestOrg1 = await axiosAuth({ email: 'test_admin1@test.com', org: 'test_org1' })
-    const FormData = (await import('form-data')).default
-    const fs = await import('fs')
-    const path = await import('path')
-
-    const tarballPath = path.join(import.meta.dirname, '..', '..', 'fixtures', 'processing-hello-world.tgz')
-    const formData = new FormData()
-    formData.append('file', fs.createReadStream(tarballPath))
-
-    const res = await superadmin.post('/api/v1/plugins', formData, {
-      headers: formData.getHeaders()
-    })
-
-    expect(res.data.name).toBe(plugin.name)
-    expect(res.data.id).toBe(pluginId)
-    expect(res.data.version).toBe('1.2.2')
-
-    await expect(adminTestOrg1.post('/api/v1/plugins')).rejects.toMatchObject({ status: 403 })
-  })
-
-  test('should update a plugin', async () => {
-    const superadmin = await axiosAuth('test_superadmin@test.com')
-    const adminTestOrg1 = await axiosAuth({ email: 'test_admin1@test.com', org: 'test_org1' })
-
-    const res = await superadmin.post('/api/v1/plugins', plugin)
-    expect(res.data.name).toBe(plugin.name)
-    expect(res.data.id).toBe(pluginId)
-    expect(res.data.version).toBe(plugin.version)
-
-    await expect(adminTestOrg1.post('/api/v1/plugins')).rejects.toMatchObject({ status: 403 })
-  })
-
-  test('should list installed plugins', async () => {
-    const superadmin = await axiosAuth('test_superadmin@test.com')
-    const adminTestOrg1 = await axiosAuth({ email: 'test_admin1@test.com', org: 'test_org1' })
-
-    let res = await superadmin.get('/api/v1/plugins')
-    expect(res.data.count).toBe(2)
-    expect(res.data.results.length).toBe(2)
-    expect(res.data.results[0].name).toBe(plugin.name)
-
-    await expect(adminTestOrg1.get('/api/v1/plugins')).rejects.toMatchObject({ status: 400 })
-
-    res = await adminTestOrg1.get('/api/v1/plugins?privateAccess=organization:test_org1')
-    expect(res.data.count).toBe(0)
-    expect(res.data.results.length).toBe(0)
-  })
-
-  test('should get specific plugin', async () => {
-    const superadmin = await axiosAuth('test_superadmin@test.com')
-
-    await expect(superadmin.get('/api/v1/plugins/does-not-exist')).rejects.toMatchObject({ status: 404 })
-
-    const res = await superadmin.get('/api/v1/plugins/' + pluginId)
-    expect(res.data.name).toBe(plugin.name)
-    expect(res.data.id).toBe(pluginId)
-    expect(res.data.version).toBe(plugin.version)
-  })
-
-  test('should manage plugin access permissions', async () => {
-    const superadmin = await axiosAuth('test_superadmin@test.com')
-    const adminTestOrg1 = await axiosAuth({ email: 'test_admin1@test.com', org: 'test_org1' })
-    const aloneUser = await axiosAuth('test_alone@test.com')
-
-    // make the plugin private with specific access to admin only
-    await superadmin.put(`/api/v1/plugins/${pluginId}/access`, {
-      public: false,
-      privateAccess: [{ type: 'organization', id: 'test_org1' }]
-    })
-
-    let res = await adminTestOrg1.get('/api/v1/plugins?privateAccess=organization:test_org1')
-    expect(res.data.results.length).toBe(1)
-
-    res = await aloneUser.get('/api/v1/plugins?privateAccess=user:test_alone')
-    expect(res.data.results.length).toBe(0)
-
-    await superadmin.put(`/api/v1/plugins/${pluginId}/access`, { public: true })
-
-    res = await adminTestOrg1.get('/api/v1/plugins?privateAccess=organization:test_org1')
-    expect(res.data.results.length).toBe(1)
-
-    res = await aloneUser.get('/api/v1/plugins?privateAccess=user:test_alone')
-    expect(res.data.results.length).toBe(1)
-  })
-
-  test('should delete a plugin', async () => {
-    const superadmin = await axiosAuth('test_superadmin@test.com')
-    const adminTestOrg1 = await axiosAuth({ email: 'test_admin1@test.com', org: 'test_org1' })
-
-    let res = await superadmin.get('/api/v1/plugins')
-    expect(res.data.count).toBe(2)
-
-    await expect(axAno.delete(`/api/v1/plugins/${pluginId}`)).rejects.toMatchObject({ status: 401 })
-    await expect(adminTestOrg1.delete(`/api/v1/plugins/${pluginId}`)).rejects.toMatchObject({ status: 403 })
-
-    res = await superadmin.delete(`/api/v1/plugins/${pluginId}`)
-    expect(res.status).toBe(204)
-
-    await expect(superadmin.get('/api/v1/plugins/' + pluginId)).rejects.toMatchObject({ status: 404 })
-    await expect(superadmin.delete(`/api/v1/plugins/${pluginId}`)).rejects.toMatchObject({ status: 404 })
-  })
-})
diff --git a/tests/features/plugins/registry.api.spec.ts b/tests/features/plugins/registry.api.spec.ts
deleted file mode 100644
index 9591949d..00000000
--- a/tests/features/plugins/registry.api.spec.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-import { test, expect } from '@playwright/test'
-import { axios } from '../../support/axios.ts'
-
-const axAno = axios()
-
-test.describe('plugin-registry', () => {
-  test('should search for plugins (just latest) on npmjs', async () => {
-    const res = await axAno.get('/api/v1/plugins-registry', { params: { q: 'hello-world' } })
-    const hwProcessingPackages = res.data.results.filter((p: { name: string }) => p.name === '@data-fair/processing-hello-world')
-    expect(hwProcessingPackages.length).toBe(1)
-    expect(res.data.results[0].distTag).toBe('latest')
-  })
-
-  test('should search for plugins and all their distTag versions on npmjs', async () => {
-    const res = await axAno.get('/api/v1/plugins-registry', { params: { q: 'hello-world', showAll: 'true' } })
-    const hwProcessingPackages = res.data.results.filter((p: { name: string }) => p.name === '@data-fair/processing-hello-world')
-    expect(hwProcessingPackages.length).toBe(2)
-    expect(['latest', 'test']).toContain(res.data.results[0].distTag)
-    expect(['latest', 'test']).toContain(res.data.results[1].distTag)
-  })
-})
diff --git a/tests/features/processings/available-plugin.e2e.spec.ts b/tests/features/processings/available-plugin.e2e.spec.ts
new file mode 100644
index 00000000..72523901
--- /dev/null
+++ b/tests/features/processings/available-plugin.e2e.spec.ts
@@ -0,0 +1,39 @@
+import { test, expect } from '../../fixtures/login.ts'
+import { axiosAuth, clean } from '../../support/axios.ts'
+import { publishFixturePlugin } from '../../support/registry.ts'
+
+/**
+ * Happy-path counterpart to broken-plugin.e2e.spec.ts: a processing whose
+ * plugin IS available in the registry must render its config form on the edit
+ * page — and must NOT show the "plugin unavailable" banner.
+ *
+ * Regression guard: the edit page fetched the registry artefact through the
+ * API-scoped `$fetch` (baseURL `/processings/api/v1`), so `/registry/...` was
+ * rewritten to `/processings/api/v1/registry/...` → 404 → every processing
+ * looked broken.
+ */
+test.describe('processing with available plugin — UI', () => {
+  test.beforeEach(clean)
+  test.afterAll(clean)
+
+  test('edit page renders the config form, no broken-plugin banner', async ({ page, goToWithAuth }) => {
+    const superadmin = await axiosAuth('test_superadmin@test.com')
+    const fixture = await publishFixturePlugin({
+      name: '@data-fair/processing-hello-world',
+      version: '1.2.2'
+    })
+    const processing = (await superadmin.post('/api/v1/processings', {
+      title: 'Healthy e2e processing',
+      plugin: fixture.pluginId,
+      owner: { type: 'user', id: 'test_superadmin', name: 'Test Super Admin' }
+    })).data
+
+    await goToWithAuth(`/processings/processings/${processing._id}`, 'test_superadmin')
+
+    await expect(page.getByText('Healthy e2e processing').first()).toBeVisible({ timeout: 10000 })
+    // The broken-plugin banner must NOT appear for an available plugin.
+    await expect(page.getByText(/Plugin indisponible/)).toHaveCount(0)
+    // The vjsf config form is rendered (v-if="processingSchema && !pluginBroken").
+    await expect(page.locator('.vjsf')).toBeVisible()
+  })
+})
diff --git a/tests/features/processings/branch-plugin.api.spec.ts b/tests/features/processings/branch-plugin.api.spec.ts
new file mode 100644
index 00000000..05d6f732
--- /dev/null
+++ b/tests/features/processings/branch-plugin.api.spec.ts
@@ -0,0 +1,79 @@
+import { test, expect } from '@playwright/test'
+import { axiosAuth, clean, waitForRunStatus } from '../../support/axios.ts'
+import { publishFixtureBranchPlugin } from '../../support/registry.ts'
+
+// Branch refs model a mutable "dev build" of a plugin — an artefact whose id
+// carries a branch-name suffix (e.g. `@data-fair-processing-hello-world-main`)
+// instead of a major; tarball slots at that id are replaced on each upload.
+// processing.plugin stores the id verbatim.
+const BRANCH_PLUGIN_ID = '@data-fair-processing-hello-world-main'
+const installBranchPlugin = async () => publishFixtureBranchPlugin({
+  artefactId: BRANCH_PLUGIN_ID
+})
+
+test.describe('processing — branch ref artefact', () => {
+  test.beforeEach(clean)
+  test.afterAll(clean)
+
+  test('creates a processing pointed at a branch ref artefact', async () => {
+    const superadmin = await axiosAuth('test_superadmin@test.com')
+    const plugin = await installBranchPlugin()
+    expect(plugin.pluginId).toBe(BRANCH_PLUGIN_ID)
+
+    const processing = (await superadmin.post('/api/v1/processings', {
+      title: 'Branch processing',
+      plugin: plugin.pluginId,
+      owner: { type: 'user', id: 'test_superadmin', name: 'Test Super Admin' }
+    })).data
+    expect(processing._id).toBeTruthy()
+    expect(processing.plugin).toBe(plugin.pluginId)
+  })
+
+  test('runs a branch-backed processing end-to-end', async () => {
+    const superadmin = await axiosAuth('test_superadmin@test.com')
+    const plugin = await installBranchPlugin()
+
+    const processing = (await superadmin.post('/api/v1/processings', {
+      title: 'Branch processing',
+      plugin: plugin.pluginId,
+      owner: { type: 'user', id: 'test_superadmin', name: 'Test Super Admin' },
+      active: true,
+      config: {
+        datasetMode: 'create',
+        dataset: { id: 'test_branch-hello-world', title: 'Branch hello world' },
+        overwrite: false,
+        message: 'Branch hello'
+      }
+    })).data
+
+    const triggered = (await superadmin.post(`/api/v1/processings/${processing._id}/_trigger`)).data
+    const finishedRun = await waitForRunStatus(triggered._id, 'finished', 30_000)
+    expect(finishedRun.status).toBe('finished')
+  })
+
+  test('re-uploading the same branch ref bumps dataUpdatedAt (cache invalidation signal)', async () => {
+    // The end-to-end "second run picks up the new tarball" path runs through
+    // data-fair (the plugin creates a dataset on first run, mode flips to
+    // update for subsequent runs). That introduces orthogonal flakiness that
+    // has nothing to do with branch-ref resolution. Instead we assert the
+    // contract lib-node-registry relies on: re-uploads bump `dataUpdatedAt`,
+    // which is the cache key.
+    await installBranchPlugin()
+    const { axiosRegistryInternal } = await import('../../support/registry.ts')
+    const before = (await axiosRegistryInternal.get(
+      '/api/v1/artefacts/' + encodeURIComponent(BRANCH_PLUGIN_ID)
+    )).data
+    expect(before.format).toBe('npm')
+    expect(before.dataUpdatedAt).toBeTruthy()
+
+    // Wait long enough that the second timestamp can't tie with the first.
+    await new Promise(resolve => setTimeout(resolve, 10))
+
+    await publishFixtureBranchPlugin({ artefactId: BRANCH_PLUGIN_ID })
+    const after = (await axiosRegistryInternal.get(
+      '/api/v1/artefacts/' + encodeURIComponent(BRANCH_PLUGIN_ID)
+    )).data
+    expect(after.dataUpdatedAt).not.toBe(before.dataUpdatedAt)
+    expect(new Date(after.dataUpdatedAt) > new Date(before.dataUpdatedAt)).toBe(true)
+  })
+})
diff --git a/tests/features/processings/broken-plugin.api.spec.ts b/tests/features/processings/broken-plugin.api.spec.ts
new file mode 100644
index 00000000..8d2c2872
--- /dev/null
+++ b/tests/features/processings/broken-plugin.api.spec.ts
@@ -0,0 +1,94 @@
+import { test, expect } from '@playwright/test'
+import { anonymousAx, apiUrl, axiosAuth, clean, waitForRunStatus } from '../../support/axios.ts'
+import { publishFixturePlugin } from '../../support/registry.ts'
+
+// Helper: create a processing through the normal API, then flip its
+// plugin to a value that doesn't resolve in the registry via the
+// dev-only test-env raw-processing PATCH endpoint.
+const createBrokenProcessing = async (
+  superadmin: Awaited<ReturnType<typeof axiosAuth>>
+) => {
+  const fixture = await publishFixturePlugin({
+    name: '@data-fair/processing-hello-world',
+    version: '1.2.2'
+  })
+  const processing = (await superadmin.post('/api/v1/processings', {
+    title: 'Broken processing',
+    plugin: fixture.pluginId,
+    owner: { type: 'user', id: 'test_superadmin', name: 'Test Super Admin' }
+  })).data
+  await anonymousAx.patch(
+    `${apiUrl}/api/v1/test-env/raw-processing/${processing._id}`,
+    { plugin: '@test-never-existed-1' }
+  )
+  return processing._id as string
+}
+
+test.describe('processing with unavailable plugin', () => {
+  test.beforeEach(clean)
+  test.afterAll(clean)
+
+  test('GET /processings/:id returns 200', async () => {
+    const superadmin = await axiosAuth('test_superadmin@test.com')
+    const id = await createBrokenProcessing(superadmin)
+
+    const res = await superadmin.get(`/api/v1/processings/${id}`)
+    expect(res.status).toBe(200)
+    expect(res.data._id).toBe(id)
+    expect(res.data.plugin).toBe('@test-never-existed-1')
+  })
+
+  test('PATCH /processings/:id surfaces the registry error', async () => {
+    const superadmin = await axiosAuth('test_superadmin@test.com')
+    const id = await createBrokenProcessing(superadmin)
+
+    const res = await superadmin.patch(
+      `/api/v1/processings/${id}`,
+      { title: 'New title' },
+      { validateStatus: () => true }
+    )
+    // Registry returns 404 for an unknown artefact. In the current
+    // implementation ensurePluginAndReadSchema does NOT forward the registry
+    // status — the unhandled AxiosRequestError propagates and Express returns
+    // 500. We include 403/404 in the set so the test also passes if the
+    // forwarding behaviour is improved in a future refactor.
+    expect([403, 404, 500]).toContain(res.status)
+  })
+
+  test('DELETE /processings/:id returns 204', async () => {
+    const superadmin = await axiosAuth('test_superadmin@test.com')
+    const id = await createBrokenProcessing(superadmin)
+
+    const del = await superadmin.delete(`/api/v1/processings/${id}`)
+    expect(del.status).toBe(204)
+
+    // GET now 404s — the processing is gone.
+    const after = await superadmin.get(
+      `/api/v1/processings/${id}`,
+      { validateStatus: () => true }
+    )
+    expect(after.status).toBe(404)
+  })
+
+  test('worker logs a friendly French message when the plugin is unavailable', async () => {
+    const superadmin = await axiosAuth('test_superadmin@test.com')
+    const id = await createBrokenProcessing(superadmin)
+
+    // Activate the processing via the raw test-env endpoint to bypass the
+    // registry check that would reject a normal PATCH for an unknown plugin.
+    await anonymousAx.patch(
+      `${apiUrl}/api/v1/test-env/raw-processing/${id}`,
+      { active: true }
+    )
+
+    const triggered = (await superadmin.post(`/api/v1/processings/${id}/_trigger`)).data
+    const triggeredRunId = triggered._id
+
+    await waitForRunStatus(triggeredRunId, 'error', 30_000)
+
+    const run = (await superadmin.get(`/api/v1/runs/${triggeredRunId}`)).data
+    expect(
+      run.log.some((l: any) => l.type === 'error' && l.msg.includes("n'est plus disponible"))
+    ).toBe(true)
+  })
+})
diff --git a/tests/features/processings/broken-plugin.e2e.spec.ts b/tests/features/processings/broken-plugin.e2e.spec.ts
new file mode 100644
index 00000000..cc5b24e0
--- /dev/null
+++ b/tests/features/processings/broken-plugin.e2e.spec.ts
@@ -0,0 +1,75 @@
+import { test, expect } from '../../fixtures/login.ts'
+import { anonymousAx, apiUrl, axiosAuth, clean } from '../../support/axios.ts'
+import { publishFixturePlugin } from '../../support/registry.ts'
+
+const setupBrokenProcessing = async () => {
+  const superadmin = await axiosAuth('test_superadmin@test.com')
+  const fixture = await publishFixturePlugin({
+    name: '@data-fair/processing-hello-world',
+    version: '1.2.2'
+  })
+  const processing = (await superadmin.post('/api/v1/processings', {
+    title: 'Broken e2e processing',
+    plugin: fixture.pluginId,
+    owner: { type: 'user', id: 'test_superadmin', name: 'Test Super Admin' }
+  })).data
+  await anonymousAx.patch(
+    `${apiUrl}/api/v1/test-env/raw-processing/${processing._id}`,
+    { plugin: '@test-never-existed-1' }
+  )
+  return processing._id as string
+}
+
+test.describe('processing with unavailable plugin — UI', () => {
+  test.beforeEach(clean)
+  test.afterAll(clean)
+
+  test('list shows the "Plugin indisponible" badge', async ({ page, goToWithAuth }) => {
+    await setupBrokenProcessing()
+    await goToWithAuth('/processings/processings', 'test_superadmin')
+    await expect(page.getByText('Broken e2e processing')).toBeVisible({ timeout: 10000 })
+    // The card list-item renders: t('pluginUnavailable') + ' — ' + processing.plugin
+    // FR locale is the test default.
+    await expect(page.getByText(/Plugin indisponible/)).toBeVisible()
+  })
+
+  test('edit page shows the banner and hides the form', async ({ page, goToWithAuth }) => {
+    const id = await setupBrokenProcessing()
+    await goToWithAuth(`/processings/processings/${id}`, 'test_superadmin')
+
+    // Banner present.
+    await expect(page.getByText(/Plugin indisponible/).first()).toBeVisible({ timeout: 10000 })
+    await expect(page.getByText(/Le plugin de ce traitement a été supprimé/)).toBeVisible()
+
+    // vjsf is not rendered when pluginBroken=true (v-if="processingSchema && !pluginBroken").
+    // Assert that no vjsf component (identified by its root class) is present.
+    await expect(page.locator('.vjsf')).toHaveCount(0)
+
+    // Delete button still present.
+    await expect(page.getByText(/Supprimer/).first()).toBeVisible()
+  })
+
+  test('delete from the edit page removes the processing', async ({ page, goToWithAuth }) => {
+    const id = await setupBrokenProcessing()
+    await goToWithAuth(`/processings/processings/${id}`, 'test_superadmin')
+
+    // Wait for the page to fully load (banner must be visible before clicking).
+    await expect(page.getByText(/Plugin indisponible/).first()).toBeVisible({ timeout: 10000 })
+
+    await page.getByText(/Supprimer/).first().click()
+    // Confirmation dialog: click the confirm button. The actions component
+    // uses t('yes') for confirm — its label is "Oui" in FR.
+    await page.getByRole('button', { name: /Oui/ }).click()
+
+    // After deletion the router redirects to /processings.
+    await page.waitForURL(/\/processings\/processings$/, { timeout: 10000 })
+
+    // Verify the processing is gone via the API.
+    const superadmin = await axiosAuth('test_superadmin@test.com')
+    const res = await superadmin.get(
+      `/api/v1/processings/${id}`,
+      { validateStatus: () => true }
+    )
+    expect(res.status).toBe(404)
+  })
+})
diff --git a/tests/features/processings/lifecycle.api.spec.ts b/tests/features/processings/lifecycle.api.spec.ts
index 74635804..291615a1 100644
--- a/tests/features/processings/lifecycle.api.spec.ts
+++ b/tests/features/processings/lifecycle.api.spec.ts
@@ -1,16 +1,16 @@
 import { test, expect } from '@playwright/test'
 import { axiosAuth, clean, waitForRunStatus } from '../../support/axios.ts'
-
-const installTestPlugin = async (superadmin: any) => {
-  const plugin = (await superadmin.post('/api/v1/plugins', {
-    name: '@data-fair/processing-hello-world',
-    version: '1.2.2',
-    distTag: 'latest',
-    description: 'Minimal plugin for data-fair-processings. Create one-line datasets on demand.'
-  })).data
-  await superadmin.put(`/api/v1/plugins/${plugin.id}/access`, { public: true })
-  return plugin
-}
+import { publishFixturePlugin } from '../../support/registry.ts'
+
+// The hello-world fixture in tests/fixtures was packed by `npm pack` and does
+// NOT carry node_modules. Tests that only assert on the API surface (create,
+// patch, list, validate) work against it as-is. Tests that trigger an actual
+// run depend on the plugin module being importable; those are now expected
+// to fail until we ship a runnable bundle (or rebuild one in beforeAll).
+const installTestPlugin = async () => publishFixturePlugin({
+  name: '@data-fair/processing-hello-world',
+  version: '1.2.2'
+})
 
 test.describe('processing', () => {
   test.beforeEach(clean)
@@ -18,11 +18,11 @@ test.describe('processing', () => {
 
   test('should create a new processing, activate it and run it', async () => {
     const superadmin = await axiosAuth('test_superadmin@test.com')
-    const plugin = await installTestPlugin(superadmin)
+    const plugin = await installTestPlugin()
 
     let processing = (await superadmin.post('/api/v1/processings', {
       title: 'Hello processing',
-      plugin: plugin.id,
+      plugin: plugin.pluginId,
       owner: { type: 'user', id: 'test_superadmin', name: 'Test Super Admin' }
     })).data
     expect(processing._id).toBeTruthy()
@@ -74,11 +74,11 @@ test.describe('processing', () => {
 
   test('should kill a long run with SIGTERM', async () => {
     const superadmin = await axiosAuth('test_superadmin@test.com')
-    const plugin = await installTestPlugin(superadmin)
+    const plugin = await installTestPlugin()
 
     const processing = (await superadmin.post('/api/v1/processings', {
       title: 'Hello processing',
-      plugin: plugin.id,
+      plugin: plugin.pluginId,
       owner: { type: 'user', id: 'test_superadmin', name: 'Test Super Admin' },
       active: true,
       config: {
@@ -102,11 +102,11 @@ test.describe('processing', () => {
 
   test('should kill a long run with SIGTERM and wait for grace period', async () => {
     const superadmin = await axiosAuth('test_superadmin@test.com')
-    const plugin = await installTestPlugin(superadmin)
+    const plugin = await installTestPlugin()
 
     const processing = (await superadmin.post('/api/v1/processings', {
       title: 'Hello processing',
-      plugin: plugin.id,
+      plugin: plugin.pluginId,
       owner: { type: 'user', id: 'test_superadmin', name: 'Test Super Admin' },
       active: true,
       config: {
@@ -128,7 +128,7 @@ test.describe('processing', () => {
 
   test('should fail a run if processings_seconds limit is exceeded', async () => {
     const superadmin = await axiosAuth('test_superadmin@test.com')
-    const plugin = await installTestPlugin(superadmin)
+    const plugin = await installTestPlugin()
 
     await superadmin.post('/api/v1/limits/user/test_superadmin', {
       processings_seconds: { limit: 1 },
@@ -137,7 +137,7 @@ test.describe('processing', () => {
 
     const processing = (await superadmin.post('/api/v1/processings', {
       title: 'Hello processing',
-      plugin: plugin.id,
+      plugin: plugin.pluginId,
       owner: { type: 'user', id: 'test_superadmin', name: 'Test Super Admin' },
       active: true,
       config: {
@@ -163,13 +163,12 @@ test.describe('processing', () => {
   })
 
   test('should manage a processing as a department admin', async () => {
-    const superadmin = await axiosAuth('test_superadmin@test.com')
-    const plugin = await installTestPlugin(superadmin)
+    const plugin = await installTestPlugin()
     const depAdmin = await axiosAuth({ email: 'test_dep_admin@test.com', org: 'test_org1', dep: 'dep1' })
 
     const processing = (await depAdmin.post('/api/v1/processings', {
       title: 'Hello processing',
-      plugin: plugin.id
+      plugin: plugin.pluginId
     })).data
 
     const processings = (await depAdmin.get('/api/v1/processings')).data
@@ -196,11 +195,11 @@ test.describe('processing', () => {
 
   test('should config a new processing with a secret field', async () => {
     const superadmin = await axiosAuth('test_superadmin@test.com')
-    const plugin = await installTestPlugin(superadmin)
+    const plugin = await installTestPlugin()
 
     const processing = (await superadmin.post('/api/v1/processings', {
       title: 'Hello processing',
-      plugin: plugin.id,
+      plugin: plugin.pluginId,
       owner: { type: 'user', id: 'test_superadmin', name: 'Test Super Admin' }
     })).data
     expect(processing._id).toBeTruthy()
@@ -241,11 +240,11 @@ test.describe('processing', () => {
 
   test('should patch config with secrets', async () => {
     const superadmin = await axiosAuth('test_superadmin@test.com')
-    const plugin = await installTestPlugin(superadmin)
+    const plugin = await installTestPlugin()
 
     const processing = (await superadmin.post('/api/v1/processings', {
       title: 'Hello processing',
-      plugin: plugin.id,
+      plugin: plugin.pluginId,
       owner: { type: 'user', id: 'test_superadmin', name: 'Test Super Admin' },
       active: true,
       config: {
diff --git a/tests/features/processings/permissions.api.spec.ts b/tests/features/processings/permissions.api.spec.ts
index ce3f98e3..ab7814cd 100644
--- a/tests/features/processings/permissions.api.spec.ts
+++ b/tests/features/processings/permissions.api.spec.ts
@@ -1,24 +1,18 @@
 import { test, expect } from '@playwright/test'
 import { axiosAuth, clean } from '../../support/axios.ts'
+import { publishFixturePlugin } from '../../support/registry.ts'
 
-const installTestPlugin = async (superadmin: any) => {
-  const plugin = (await superadmin.post('/api/v1/plugins', {
-    name: '@data-fair/processing-hello-world',
-    version: '0.12.2',
-    distTag: 'latest',
-    description: 'Minimal plugin for data-fair-processings. Create one-line datasets on demand.'
-  })).data
-  await superadmin.put(`/api/v1/plugins/${plugin.id}/access`, { public: true })
-  return plugin
-}
+const installTestPlugin = async () => publishFixturePlugin({
+  name: '@data-fair/processing-hello-world',
+  version: '1.2.2'
+})
 
 test.describe('processing permissions', () => {
   test.beforeEach(clean)
   test.afterAll(clean)
 
   test('should create a processing and check permissions across roles', async () => {
-    const superadmin = await axiosAuth('test_superadmin@test.com')
-    const plugin = await installTestPlugin(superadmin)
+    const plugin = await installTestPlugin()
 
     const adminTestOrg1 = await axiosAuth({ email: 'test_admin1@test.com', org: 'test_org1' })
     const contribTestOrg1 = await axiosAuth({ email: 'test_contrib1@test.com', org: 'test_org1' })
@@ -28,7 +22,7 @@ test.describe('processing permissions', () => {
 
     const processing = (await adminTestOrg1.post('/api/v1/processings', {
       title: 'Hello processing',
-      plugin: plugin.id
+      plugin: plugin.pluginId
     })).data
 
     await adminTestOrg1.patch(`/api/v1/processings/${processing._id}`, {
@@ -95,23 +89,23 @@ test.describe('processing permissions', () => {
     await expect(partnerAdmin.patch(`/api/v1/processings/${processing._id}`, { title: 'test' })).rejects.toMatchObject({ status: 403 })
     await expect(aloneOutsider.patch(`/api/v1/processings/${processing._id}`, { title: 'test' })).rejects.toMatchObject({ status: 403 })
 
-    await superadmin.delete(`/api/v1/plugins/${plugin.id}`)
+    // plugin lifecycle is managed by registry now — no per-test deletion
   })
 
   test('should list processings with proper org isolation', async () => {
     const superadmin = await axiosAuth('test_superadmin@test.com')
-    const plugin = await installTestPlugin(superadmin)
+    const plugin = await installTestPlugin()
 
     const adminTestOrg1 = await axiosAuth({ email: 'test_admin1@test.com', org: 'test_org1' })
     const partnerAdmin = await axiosAuth({ email: 'test_user2@test.com', org: 'test_org2' })
 
     await adminTestOrg1.post('/api/v1/processings', {
       title: 'Hello processing 1',
-      plugin: plugin.id
+      plugin: plugin.pluginId
     })
     await partnerAdmin.post('/api/v1/processings', {
       title: 'Hello processing 2',
-      plugin: plugin.id
+      plugin: plugin.pluginId
     })
 
     expect((await adminTestOrg1.get('/api/v1/processings?owner=organization:test_org1')).data.count).toBe(1)
@@ -122,14 +116,13 @@ test.describe('processing permissions', () => {
   })
 
   test('should manage processings as a department admin', async () => {
-    const superadmin = await axiosAuth('test_superadmin@test.com')
-    const plugin = await installTestPlugin(superadmin)
+    const plugin = await installTestPlugin()
     const depAdmin = await axiosAuth({ email: 'test_dep_admin@test.com', org: 'test_org1', dep: 'dep1' })
 
     // create a processing in his department
     const processing = (await depAdmin.post('/api/v1/processings', {
       title: 'Hello processing',
-      plugin: plugin.id,
+      plugin: plugin.pluginId,
       owner: {
         id: 'test_org1',
         name: 'Test Org 1',
@@ -143,7 +136,7 @@ test.describe('processing permissions', () => {
     // cannot create in another department
     await expect(depAdmin.post('/api/v1/processings', {
       title: 'Hello processing',
-      plugin: plugin.id,
+      plugin: plugin.pluginId,
       owner: {
         id: 'test_org1',
         name: 'Test Org 1',
@@ -156,7 +149,7 @@ test.describe('processing permissions', () => {
     // cannot create in the root organization (no department)
     await expect(depAdmin.post('/api/v1/processings', {
       title: 'Hello processing',
-      plugin: plugin.id,
+      plugin: plugin.pluginId,
       owner: {
         id: 'test_org1',
         name: 'Test Org 1',
diff --git a/tests/features/ui/layout.e2e.spec.ts b/tests/features/ui/layout.e2e.spec.ts
index 47026ea6..79366473 100644
--- a/tests/features/ui/layout.e2e.spec.ts
+++ b/tests/features/ui/layout.e2e.spec.ts
@@ -1,8 +1,6 @@
-import path from 'node:path'
-import fs from 'node:fs'
-import FormData from 'form-data'
 import { test, expect } from '../../fixtures/login.ts'
 import { axiosAuth, clean } from '../../support/axios.ts'
+import { publishFixturePlugin } from '../../support/registry.ts'
 
 test.describe('UI layout', () => {
   test.beforeEach(clean)
@@ -15,16 +13,14 @@ test.describe('UI layout', () => {
 
   test('processings list renders a card for an existing processing', async ({ page, goToWithAuth }) => {
     const superadmin = await axiosAuth('test_superadmin@test.com')
-
-    const tarballPath = path.join(import.meta.dirname, '..', '..', 'fixtures', 'processing-hello-world.tgz')
-    const formData = new FormData()
-    formData.append('file', fs.createReadStream(tarballPath))
-    const plugin = (await superadmin.post('/api/v1/plugins', formData, { headers: formData.getHeaders() })).data
-    await superadmin.put(`/api/v1/plugins/${plugin.id}/access`, { public: true })
+    const fixture = await publishFixturePlugin({
+      name: '@data-fair/processing-hello-world',
+      version: '1.2.2'
+    })
 
     await superadmin.post('/api/v1/processings', {
       title: 'My e2e processing',
-      plugin: plugin.id,
+      plugin: fixture.pluginId,
       owner: { type: 'user', id: 'test_superadmin', name: 'Test Super Admin' }
     })
 
diff --git a/tests/state-setup.ts b/tests/state-setup.ts
index 742db2c4..1f8d9d09 100644
--- a/tests/state-setup.ts
+++ b/tests/state-setup.ts
@@ -3,6 +3,7 @@ import { spawn } from 'node:child_process'
 import { axiosBuilder } from '@data-fair/lib-node/axios.js'
 import { test as setup } from '@playwright/test'
 import { apiUrl } from './support/axios.ts'
+import { seedDataFairApiKey } from './support/data-fair.ts'
 
 const ax = axiosBuilder()
 
@@ -14,6 +15,10 @@ setup('Stateful tests setup', async () => {
 If you are an agent do not try to start it. Instead check for a startup failure at the end of dev/logs/dev-api.log and report this problem to your user.`
   )
 
+  // Seed an admin-mode API key in data-fair's mongo so the worker can talk
+  // to data-fair on behalf of any test owner. Idempotent.
+  await seedDataFairApiKey()
+
   // More visible dev server logs straight in the test output
   try {
     const { existsSync, mkdirSync } = await import('node:fs')
diff --git a/tests/support/axios.ts b/tests/support/axios.ts
index dbf29bea..4c0e12e9 100644
--- a/tests/support/axios.ts
+++ b/tests/support/axios.ts
@@ -43,6 +43,10 @@ export const clean = async () => {
   await waitForWorkerIdle()
   await anonymousAx.delete(`${apiUrl}/api/v1/test-env`)
   await anonymousAx.delete(`${apiUrl}/api/v1/test-env/plugins`)
+  // Registry has no test-env endpoint — drop the db directly. Lazy import to
+  // avoid pulling the mongodb client into specs that don't need it.
+  const { cleanRegistryDb } = await import('./registry.ts')
+  await cleanRegistryDb()
 }
 
 /** Poll the test-env raw-run endpoint until status matches one of the given values. */
diff --git a/tests/support/data-fair.ts b/tests/support/data-fair.ts
new file mode 100644
index 00000000..36a7c334
--- /dev/null
+++ b/tests/support/data-fair.ts
@@ -0,0 +1,47 @@
+import crypto from 'node:crypto'
+import { MongoClient } from 'mongodb'
+
+/**
+ * Seed an admin-mode API key into data-fair's mongo settings collection so
+ * the worker can call /api/v1/datasets etc. on behalf of any test owner.
+ *
+ * Worker dev config hardcodes the same raw key (see
+ * `worker/config/development.mjs`); state-setup calls this helper once per
+ * test run, idempotently. The key is sha512-hashed before storage to match
+ * what data-fair's `readApiKey` middleware looks up.
+ */
+
+export const DEV_TEST_DF_API_KEY = 'dev-test-processings-worker-key'
+
+const SETTINGS_DOC_ID = 'user:processings-worker-test'
+
+export const seedDataFairApiKey = async (rawKey: string = DEV_TEST_DF_API_KEY) => {
+  const url = `mongodb://localhost:${process.env.MONGO_PORT ?? '27017'}/data-fair`
+  const client = new MongoClient(url)
+  try {
+    await client.connect()
+    const db = client.db()
+    const hashedKey = crypto.createHash('sha512').update(rawKey).digest('hex')
+    await db.collection('settings').updateOne(
+      { _id: SETTINGS_DOC_ID as any },
+      {
+        $set: {
+          id: 'processings-worker-test',
+          type: 'user',
+          name: 'Processings worker test key',
+          apiKeys: [{
+            id: 'worker',
+            title: 'Processings worker (dev/test)',
+            key: hashedKey,
+            scopes: ['datasets', 'applications', 'catalogs', 'stats'],
+            adminMode: true,
+            asAccount: true
+          }]
+        }
+      },
+      { upsert: true }
+    )
+  } finally {
+    await client.close()
+  }
+}
diff --git a/tests/support/registry.ts b/tests/support/registry.ts
new file mode 100644
index 00000000..9b598eb4
--- /dev/null
+++ b/tests/support/registry.ts
@@ -0,0 +1,205 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import FormData from 'form-data'
+import { MongoClient } from 'mongodb'
+import { axiosBuilder } from '@data-fair/lib-node/axios.js'
+
+/**
+ * Registry test harness — talks to the dev-mode registry container at
+ * /registry on the same nginx as processings, with the matching internal
+ * secret defined in `docker-compose.yml`.
+ *
+ * Tests publish their fixture plugin once at the top of a describe block (or
+ * via state-setup) and reset registry state between runs by dropping the
+ * `data-fair-registry` mongo db directly.
+ */
+
+// Through nginx for browser-visible reads (matches what the UI does in dev).
+export const registryBaseUrl = `http://${process.env.DEV_HOST}:${process.env.NGINX_PORT1}/registry`
+// Direct to the registry container for internal-secret writes — the registry
+// only honours x-secret-key when reqIsInternal is true, which checks for the
+// absence of x-forwarded-host. nginx adds that header, so internal calls have
+// to skip the proxy.
+export const registryInternalUrl = `http://localhost:${process.env.REGISTRY_PORT}/registry`
+export const registryInternalSecret = 'secret-registry-internal'
+
+export const axiosRegistryInternal = axiosBuilder({
+  baseURL: registryInternalUrl,
+  headers: { 'x-secret-key': registryInternalSecret }
+})
+
+export interface PublishedFixture {
+  /** Registry artefact id — the value stored on `processing.plugin`. */
+  pluginId: string
+}
+
+export type Grantee = { type: 'user' | 'organization', id: string }
+
+export interface PublishOptions {
+  /** npm package name as it appears in package.json — used in the upload URL. */
+  name: string
+  /** Full semver of the version being uploaded (e.g. `1.2.3`). */
+  version: string
+  /** Defaults to the host architecture. */
+  architecture?: string
+  /** Local path to the .tgz to upload. */
+  tarballPath?: string
+  /** Set the artefact public (default true) — the cheap path for most tests. */
+  isPublic?: boolean
+  /** Per-account `privateAccess` entries on the artefact. */
+  privateAccess?: Grantee[]
+  /**
+   * Global access-grants to create (POST /api/v1/access-grants). Registry's
+   * canDownload requires a grant for the calling account even when the
+   * artefact is public, so the API & worker hitting the registry on behalf
+   * of `processing.owner` will 403 unless that owner has a grant.
+   *
+   * Defaults to the test accounts the lifecycle / permissions / ui specs
+   * use as `processing.owner`. Any privateAccess entries are also granted
+   * automatically — there is no scenario where a privateAccess entry
+   * should not also have a grant.
+   */
+  grants?: Grantee[]
+}
+
+const DEFAULT_GRANTS: Grantee[] = [
+  { type: 'user', id: 'test_superadmin' },
+  { type: 'organization', id: 'test_org1' },
+  { type: 'organization', id: 'test_org2' }
+]
+
+const DEFAULT_TARBALL = path.resolve(import.meta.dirname, '../fixtures/processing-hello-world.tgz')
+
+/**
+ * Publish a fixture plugin to registry as the internal service. Patches the
+ * artefact metadata so it is visible to the test owner, and returns the
+ * artefact id string that `processing.plugin` expects.
+ *
+ * NOTE: the bundled `processing-hello-world.tgz` fixture is the plain
+ * `npm pack` output and does NOT include `node_modules`. That is fine for
+ * tests that only exercise the API surface (validate, prepare list, picker).
+ * Tests that actually trigger a run need a runnable bundle — generate one in
+ * a beforeAll (npm install + repack into a tmp tarball) or assert on
+ * non-execution behaviour.
+ */
+export interface PublishBranchOptions {
+  /** Registry artefact id (the v5 id form, e.g. `@data-fair-processing-hello-world-main`). */
+  artefactId: string
+  /** Local path to the .tgz to upload. */
+  tarballPath?: string
+  /** Optional architecture tag. */
+  architecture?: string
+  /** Set the artefact public (default true). */
+  isPublic?: boolean
+  /** Per-account `privateAccess` entries on the artefact. */
+  privateAccess?: Grantee[]
+  /** Global access-grants to create (defaults to the test owner set). */
+  grants?: Grantee[]
+}
+
+/**
+ * Publish a fixture plugin as a branch ref — an artefact whose id carries a
+ * non-numeric (branch-name) suffix instead of a major (e.g.
+ * `@data-fair-processing-hello-world-main`); its tarball slots are replaced on
+ * each upload. The returned `pluginId` is the artefact id verbatim.
+ */
+export const publishFixtureBranchPlugin = async (opts: PublishBranchOptions): Promise<PublishedFixture> => {
+  const tarballPath = opts.tarballPath ?? DEFAULT_TARBALL
+  const tgz = await fs.promises.readFile(tarballPath)
+
+  const form = new FormData()
+  form.append('file', tgz, { filename: 'package.tgz', contentType: 'application/gzip' })
+  if (opts.architecture) form.append('architecture', opts.architecture)
+  await axiosRegistryInternal.post(
+    `/api/v1/artefacts/npm/${encodeURIComponent(opts.artefactId)}`,
+    form,
+    { headers: form.getHeaders() }
+  )
+
+  await axiosRegistryInternal.patch(`/api/v1/artefacts/${encodeURIComponent(opts.artefactId)}`, {
+    public: opts.isPublic ?? true,
+    privateAccess: opts.privateAccess ?? []
+  })
+
+  const grants = opts.grants ?? DEFAULT_GRANTS
+  const seen = new Set<string>()
+  for (const acc of [...(opts.privateAccess ?? []), ...grants]) {
+    const key = `${acc.type}:${acc.id}`
+    if (seen.has(key)) continue
+    seen.add(key)
+    await axiosRegistryInternal.post(
+      '/api/v1/access-grants',
+      { account: acc },
+      { validateStatus: s => s === 201 || s === 409 }
+    )
+  }
+
+  return { pluginId: opts.artefactId }
+}
+
+export const publishFixturePlugin = async (opts: PublishOptions): Promise<PublishedFixture> => {
+  const tarballPath = opts.tarballPath ?? DEFAULT_TARBALL
+  const tgz = await fs.promises.readFile(tarballPath)
+  const arch = opts.architecture ?? process.arch
+
+  const major = parseInt(opts.version.split('.')[0], 10)
+  // The artefact id is the v5 id form (`{name}` with `/` flattened to `-`, plus
+  // `-{major}`) — the same value stored on `processing.plugin`.
+  const pluginId = `${opts.name.replace('/', '-')}-${major}`
+
+  const form = new FormData()
+  form.append('architecture', arch)
+  form.append('file', tgz, { filename: 'package.tgz', contentType: 'application/gzip' })
+  await axiosRegistryInternal.post(
+    `/api/v1/artefacts/npm/${encodeURIComponent(pluginId)}`,
+    form,
+    { headers: form.getHeaders() }
+  )
+
+  await axiosRegistryInternal.patch(`/api/v1/artefacts/${encodeURIComponent(pluginId)}`, {
+    public: opts.isPublic ?? true,
+    privateAccess: opts.privateAccess ?? []
+  })
+
+  // Always grant the privateAccess set + the default test owners. Dedup so
+  // the same account isn't POSTed twice (registry would 409 on the dup, which
+  // we accept, but keeping it tidy).
+  const grants = opts.grants ?? DEFAULT_GRANTS
+  const seen = new Set<string>()
+  for (const acc of [...(opts.privateAccess ?? []), ...grants]) {
+    const key = `${acc.type}:${acc.id}`
+    if (seen.has(key)) continue
+    seen.add(key)
+    await axiosRegistryInternal.post(
+      '/api/v1/access-grants',
+      { account: acc },
+      { validateStatus: s => s === 201 || s === 409 }
+    )
+  }
+
+  return { pluginId }
+}
+
+/**
+ * Drop the registry mongo db AND the API/worker tarball caches. Called from
+ * `clean()` between tests so a re-published fixture (same ref, possibly
+ * different content) is actually re-downloaded — lib-node-registry's cache
+ * key is `{artefactId}/{arch}` and would otherwise serve stale extracted
+ * files from the previous test.
+ */
+export const cleanRegistryDb = async () => {
+  const url = `mongodb://localhost:${process.env.MONGO_PORT ?? '27017'}/data-fair-registry`
+  const client = new MongoClient(url)
+  try {
+    await client.connect()
+    await client.db().dropDatabase()
+  } finally {
+    await client.close()
+  }
+  // The API and worker each have their own tarball cache under
+  // <dataDir>/tmp/registry-cache (dev config: ../data/development/tmp/...).
+  // Wiping both keeps tests deterministic across rebuilds of the fixture.
+  const repoRoot = path.resolve(import.meta.dirname, '../..')
+  const cacheRoot = path.join(repoRoot, 'data/development/tmp/registry-cache')
+  await fs.promises.rm(cacheRoot, { recursive: true, force: true })
+}
diff --git a/ui/src/components/processing/processing-actions.vue b/ui/src/components/processing/processing-actions.vue
index 0ea02ea1..809d14e7 100644
--- a/ui/src/components/processing/processing-actions.vue
+++ b/ui/src/components/processing/processing-actions.vue
@@ -1,7 +1,7 @@
 <template>
   <!-- Execute -->
   <v-menu
-    v-if="canAdmin || canExec"
+    v-if="(canAdmin || canExec) && !pluginBroken"
     v-model="showTriggerMenu"
     :close-on-content-click="false"
     max-width="800"
@@ -65,7 +65,7 @@
 
   <!-- Duplicate -->
   <v-menu
-    v-if="canAdmin"
+    v-if="canAdmin && !pluginBroken"
     v-model="showDuplicateMenu"
     :close-on-content-click="false"
     max-width="500"
@@ -168,7 +168,7 @@
 
   <!-- Change owner -->
   <v-menu
-    v-if="canAdmin"
+    v-if="canAdmin && !pluginBroken"
     v-model="showChangeOwnerMenu"
     :close-on-content-click="false"
     max-width="500"
@@ -248,8 +248,8 @@
 
   <!-- Documentation link -->
   <v-list-item
-    v-if="metadata?.documentation"
-    :href="metadata.documentation"
+    v-if="documentation"
+    :href="documentation"
     target="_blank"
     rounded
   >
@@ -316,13 +316,14 @@ import '@data-fair/frame/lib/d-frame.js'
 
 const emit = defineEmits(['triggered'])
 
-const { canAdmin, canExec, edited, metadata, processing, processingSchema } = defineProps<{
+const { canAdmin, canExec, edited, documentation, processing, processingSchema, pluginBroken } = defineProps<{
   canAdmin: boolean,
   canExec: boolean,
   edited: boolean,
-  metadata: Record<string, any> | undefined,
+  documentation?: string,
   processing: Record<string, any>,
   processingSchema: Record<string, any>,
+  pluginBroken?: boolean,
 }>()
 
 const { t } = useI18n()
diff --git a/ui/src/components/processing/processing-card.vue b/ui/src/components/processing/processing-card.vue
index 3e586262..5b579ec4 100644
--- a/ui/src/components/processing/processing-card.vue
+++ b/ui/src/components/processing/processing-card.vue
@@ -37,7 +37,10 @@
             width="3"
           />
         </v-list-item>
-        <v-list-item v-else-if="pluginFetch.error.value?.statusCode">
+        <v-list-item
+          v-else-if="pluginFetch.error.value?.statusCode"
+          :title="t('pluginUnavailableHint')"
+        >
           <template #prepend>
             <v-icon
               :icon="mdiPowerPlug"
@@ -45,14 +48,14 @@
             />
           </template>
           <span class="text-error">
-            {{ t('deleted') + ' - ' + processing.plugin }}
+            {{ t('pluginUnavailable') + ' — ' + processing.plugin }}
           </span>
         </v-list-item>
         <v-list-item v-else>
           <template #prepend>
             <v-icon :icon="mdiPowerPlug" />
           </template>
-          {{ pluginFetch.data.value?.metadata.name }}
+          {{ pluginFetch.data.value?.title?.fr ?? pluginFetch.data.value?.title?.en ?? pluginFetch.data.value?.name ?? processing.plugin }}
         </v-list-item>
 
         <!-- Linked dataset -->
@@ -192,7 +195,8 @@ const pluginFetch = usePluginFetch(props.processing.plugin)
 
 <i18n lang="yaml">
   en:
-    deleted: Deleted
+    pluginUnavailable: Plugin unavailable
+    pluginUnavailableHint: This processing's plugin has been removed or its access revoked. You can no longer edit or run it, but you can view its history and delete it.
     runStarted: Run started
     lastRunFinished: Last run finished
     duration: "Duration:"
@@ -206,7 +210,8 @@ const pluginFetch = usePluginFetch(props.processing.plugin)
     inactive: Inactive
 
   fr:
-    deleted: Supprimé
+    pluginUnavailable: Plugin indisponible
+    pluginUnavailableHint: Le plugin de ce traitement a été supprimé ou son accès retiré. Vous ne pouvez plus le modifier ni l'exécuter, mais vous pouvez consulter son historique et le supprimer.
     runStarted: Exécution commencée
     lastRunFinished: Dernière exécution terminée
     duration: "Durée :"
diff --git a/ui/src/components/processings-actions.vue b/ui/src/components/processings-actions.vue
index 2fa4dff6..bc27df83 100644
--- a/ui/src/components/processings-actions.vue
+++ b/ui/src/components/processings-actions.vue
@@ -130,23 +130,18 @@ const statusesText = computed<Record<string, string>>(() => ({
   triggered: t('statusTriggered')
 }))
 
-type InstalledPlugin = {
+// Subset of registry's Artefact shape used to render the plugin filter labels.
+type RegistryArtefact = {
+  _id: string
   name: string
-  description: string
-  version: string
-  distTag: string
-  id: string
-  pluginConfigSchema: any
-  processingConfigSchema: any
-  metadata: {
-    name: string
-    description: string
-    category: string
-    icon: Record<string, string>
-  }
+  majorVersion: number
+  title?: { fr?: string, en?: string }
 }
 
-const installedPluginsFetch = useFetch<{ results: InstalledPlugin[], count: number }>(`${$apiPath}/plugins?privateAccess=${processingsProps.ownerFilter}`)
+const installedPluginsFetch = useFetch<{ results: RegistryArtefact[], count: number }>(
+  '/registry/api/v1/artefacts',
+  { query: { category: 'processing', size: 200 } }
+)
 const installedPlugins = computed(() => installedPluginsFetch.data.value?.results)
 
 const eventsSubscribeUrl = computed(() => {
@@ -175,10 +170,13 @@ const pluginsItems = computed(() => {
   if (!installedPlugins.value) return []
   if (!processingsProps.facets.plugins) return []
 
+  // facets.plugins keys are the registry artefact id stored on `plugin`,
+  // matching registry artefact._id directly.
   return Object.entries(processingsProps.facets.plugins)
     .map(
       ([pluginKey, count]) => {
-        const customName = installedPlugins.value?.find((plugin) => plugin.id === pluginKey)?.metadata.name
+        const artefact = installedPlugins.value?.find((p) => p._id === pluginKey)
+        const customName = artefact?.title?.fr ?? artefact?.title?.en ?? artefact?.name
         return {
           display: `${customName || t('deleted') + ' - ' + pluginKey} (${count})`,
           pluginKey
diff --git a/ui/src/composables/use-plugin-fetch.ts b/ui/src/composables/use-plugin-fetch.ts
index faba6c24..c64b0308 100644
--- a/ui/src/composables/use-plugin-fetch.ts
+++ b/ui/src/composables/use-plugin-fetch.ts
@@ -1,12 +1,39 @@
-import type { Plugin } from '#api/types'
+// Subset of registry's Artefact shape that the UI uses. The artefact `_id` is
+// exactly what we store on `processing.plugin`, so we fetch the artefact by that.
+export interface RegistryArtefact {
+  _id: string
+  name: string
+  format?: 'npm' | 'file'
+  version?: string
+  category: string
+  title?: { fr?: string, en?: string }
+  description?: { fr?: string, en?: string }
+  group?: { fr?: string, en?: string }
+  documentation?: string
+  thumbnail?: { id: string, width: number, height: number }
+}
 
-const fetches: Record<string, ReturnType<typeof useFetch<Plugin>>> = {}
+const fetches: Record<string, ReturnType<typeof useFetch<RegistryArtefact>>> = {}
 
+/**
+ * Fetch artefact metadata from the registry for a processing's `plugin`
+ * (the registry artefact id).
+ *
+ * Errors (404 deleted, 403 no access) are NOT broadcast as a global ui
+ * notification — callers read `error.value` and render their own inline
+ * state. See processing-card.vue and pages/processings/[id]/index.vue.
+ *
+ * Same-domain assumption: registry is always mounted at `/registry` of the
+ * current domain. The session cookie is sent automatically.
+ */
 export const usePluginFetch = (pluginId: string) => {
   if (!fetches[pluginId]) {
-    const pluginFetch = useFetch<Plugin>(`${$apiPath}/plugins/${pluginId}`)
-    fetches[pluginId] = pluginFetch
+    fetches[pluginId] = useFetch<RegistryArtefact>(
+      `/registry/api/v1/artefacts/${encodeURIComponent(pluginId)}`,
+      { notifError: false }
+    )
   }
   return fetches[pluginId]
 }
+
 export default usePluginFetch
diff --git a/ui/src/pages/admin/index.vue b/ui/src/pages/admin/index.vue
deleted file mode 100644
index fc59f41e..00000000
--- a/ui/src/pages/admin/index.vue
+++ /dev/null
@@ -1,9 +0,0 @@
-<template>
-  <div />
-</template>
-
-<script setup lang="ts">
-// Always redirect to the plugins page
-const router = useRouter()
-router.push('/admin/plugins')
-</script>
diff --git a/ui/src/pages/admin/plugins.vue b/ui/src/pages/admin/plugins.vue
deleted file mode 100644
index 73dc1c02..00000000
--- a/ui/src/pages/admin/plugins.vue
+++ /dev/null
@@ -1,675 +0,0 @@
-<template>
-  <v-container data-iframe-height>
-    <!-- Search field -->
-    <search-field
-      v-model="search"
-      autofocus
-      class="mx-n4"
-    />
-
-    <v-list-subheader>
-      <v-progress-circular
-        v-if="installedPluginsFetch.loading.value"
-        color="primary"
-        size="16"
-        width="2"
-        indeterminate
-      />
-      <v-icon
-        v-else-if="installedPluginsFetch.error.value"
-        :icon="mdiAlert"
-        color="error"
-      />
-      <template v-else-if="installedPluginsFetch.data.value">
-        {{ installedPluginsFetch.data.value.count }}
-      </template>
-      {{ t('installedPluginsLabel') }}
-    </v-list-subheader>
-    <v-skeleton-loader
-      v-if="installedPluginsFetch.loading.value"
-      :class="$vuetify.theme.current.dark ? 'my-4' : 'my-4 skeleton'"
-      :height="100"
-      type="list-item-two-line"
-    />
-
-    <v-card
-      v-for="result in filteredInstalledPlugins"
-      :key="'installed-' + result.id"
-      :loading="pluginLocked === `${result.id}` ? 'primary' : false"
-      class="mb-4"
-    >
-      <v-toolbar
-        :title="result.distTag === 'latest' ? result.name : result.name + ' (' + result.distTag + ')'"
-        density="compact"
-        variant="outlined"
-        flat
-      >
-        <template #append>
-          {{ t('usageCount', { count: result.usages }) }} - {{ result.version }}
-          <template v-if="updateInfoById[result.id]?.available">
-            <v-btn
-              v-if="!updateInfoById[result.id]?.isMajor"
-              :disabled="!!pluginLocked"
-              :icon="mdiUpdate"
-              :title="t('updateWithVersion', { version: updateInfoById[result.id]?.version })"
-              color="primary"
-              @click="update(result)"
-            />
-            <v-menu
-              v-else
-              :key="`major-update-${result.id}`"
-              :close-on-content-click="false"
-              max-width="500"
-            >
-              <template #activator="{ props }">
-                <v-btn
-                  v-bind="props"
-                  :disabled="!!pluginLocked"
-                  :icon="mdiUpdate"
-                  :title="t('updateWithVersion', { version: updateInfoById[result.id]?.version })"
-                  color="warning"
-                  @click="showMajorUpdateMenu = result.id"
-                />
-              </template>
-              <v-card v-if="showMajorUpdateMenu === result.id">
-                <v-card-title>
-                  {{ t('majorInstallTitleWithVersions') }}
-                </v-card-title>
-                <v-progress-linear
-                  v-if="pluginLocked === `${result.id}`"
-                  color="warning"
-                  indeterminate
-                />
-                <v-card-text>
-                  {{ t('majorInstallBody') }}
-                </v-card-text>
-                <v-card-actions>
-                  <v-spacer />
-                  <v-btn
-                    :disabled="!!pluginLocked"
-                    @click="showMajorUpdateMenu = null"
-                  >
-                    {{ t('cancel') }}
-                  </v-btn>
-                  <v-btn
-                    :disabled="!!pluginLocked"
-                    color="primary"
-                    variant="flat"
-                    @click="showMajorUpdateMenu = null; update(result)"
-                  >
-                    {{ t('install') }}
-                  </v-btn>
-                </v-card-actions>
-              </v-card>
-            </v-menu>
-          </template>
-          <v-menu
-            :key="result.id"
-            :close-on-content-click="false"
-            max-width="500"
-          >
-            <template #activator="{ props }">
-              <v-btn
-                v-bind="props"
-                :disabled="!!pluginLocked"
-                :icon="mdiDelete"
-                :title="t('uninstall')"
-                color="warning"
-                @click="showDeleteMenu = result.id"
-              />
-            </template>
-            <v-card v-if="showDeleteMenu">
-              <v-card-title>
-                {{ t('uninstallTitle') }}
-              </v-card-title>
-              <v-progress-linear
-                v-if="pluginLocked === `${result.id}`"
-                color="warning"
-                indeterminate
-              />
-              <v-card-text>
-                {{ t('uninstallConfirm', { name: result.name }) }}
-              </v-card-text>
-              <v-card-actions>
-                <v-spacer />
-                <v-btn
-                  :disabled="!!pluginLocked"
-                  @click="showDeleteMenu = null"
-                >
-                  {{ t('no') }}
-                </v-btn>
-                <v-btn
-                  :disabled="!!pluginLocked"
-                  color="warning"
-                  variant="flat"
-                  @click="uninstall.execute(result)"
-                >
-                  {{ t('yes') }}
-                </v-btn>
-              </v-card-actions>
-            </v-card>
-          </v-menu>
-        </template>
-      </v-toolbar>
-
-      <v-card-text class="py-2">
-        <p
-          v-if="result.description"
-          class="mb-2"
-        >
-          {{ result.description }}
-        </p>
-        <private-access
-          :patch="result.access"
-          @change="(newAccess: any) => { result.access = newAccess; save(result, 'access') }"
-        />
-        <v-form
-          :ref="'form-metadata-' + result.id"
-          class="mt-4"
-          autocomplete="off"
-        >
-          <vjsf
-            v-model="result.metadata"
-            :options="vjsfOptions"
-            :schema="result.pluginMetadataSchema"
-            @update:model-value="save(result, 'metadata')"
-          />
-        </v-form>
-        <v-form
-          :ref="'form-config-' + result.id"
-          v-model="valid['form-config-' + result.id]"
-          autocomplete="off"
-        >
-          <vjsf
-            v-if="result.pluginConfigSchema.properties && Object.keys(result.pluginConfigSchema.properties).length"
-            v-model="result.config"
-            :options="vjsfOptions"
-            :schema="result.pluginConfigSchema"
-            @update:model-value="valid['form-config-' + result.id] ? save(result, 'config') : null"
-          />
-        </v-form>
-      </v-card-text>
-    </v-card>
-
-    <v-list-subheader>
-      <v-progress-circular
-        v-if="availablePluginsFetch.loading.value"
-        color="primary"
-        size="16"
-        width="2"
-        indeterminate
-      />
-      <span v-else-if="filteredAvailablePlugins">
-        {{ filteredAvailablePlugins.length }}
-      </span>
-      {{ t('availablePluginsLabel') }}
-
-      <v-menu
-        v-model="showManualInstallMenu"
-        :close-on-content-click="false"
-        max-width="500"
-      >
-        <template #activator="{ props }">
-          <v-btn
-            v-bind="props"
-            class="ml-2"
-            density="comfortable"
-            variant="flat"
-            color="primary"
-            :disabled="!!pluginLocked"
-          >
-            {{ t('manualInstall') }}
-          </v-btn>
-        </template>
-        <v-card
-          :loading="install.loading.value ? 'warning' : false"
-          :title="t('manualInstallTitle')"
-        >
-          <v-card-text class="pb-0">
-            <div class="mb-4">
-              <p class="text-body-medium font-italic mb-2">
-                {{ t('manualInstallFromNpm') }}
-              </p>
-              <v-text-field
-                v-model="manualInstallPlugin.name"
-                :disabled="!!pluginLocked || !!selectedFile"
-                :label="t('manualInstallName')"
-                :loading="availablePluginsFetch.loading.value"
-                placeholder="@data-fair/processing-my-plugin"
-                class="mb-2"
-                autofocus
-                hide-details
-              />
-              <v-text-field
-                v-model="manualInstallPlugin.version"
-                :disabled="!!pluginLocked || !!selectedFile"
-                :label="t('manualInstallVersion')"
-                placeholder="1.0.0"
-                class="mb-2"
-                hide-details
-              />
-              <v-text-field
-                v-model="manualInstallPlugin.distTag"
-                :disabled="!!pluginLocked || !!selectedFile"
-                :label="t('manualInstallDistTag')"
-                placeholder="latest"
-                hide-details
-              />
-            </div>
-
-            <div>
-              <p class="text-body-medium font-italic mb-2">
-                {{ t('manualInstallFromFile') }}
-              </p>
-              <v-file-input
-                v-model="selectedFile"
-                :disabled="!!pluginLocked || hasNpmFields"
-                :label="t('manualInstallFileLabel')"
-                accept=".tgz"
-                chips
-                hide-details
-                show-size
-              />
-            </div>
-          </v-card-text>
-          <v-card-actions>
-            <v-spacer />
-            <v-btn
-              :disabled="!!pluginLocked || install.loading.value"
-              @click="resetManualInstallFrom()"
-            >
-              {{ t('cancel') }}
-            </v-btn>
-            <v-btn
-              :disabled="!!pluginLocked || !canForceInstall || install.loading.value"
-              color="warning"
-              variant="flat"
-              @click="install.execute()"
-            >
-              {{ t('install') }}
-            </v-btn>
-          </v-card-actions>
-        </v-card>
-      </v-menu>
-    </v-list-subheader>
-
-    <v-checkbox
-      v-model="query.showAll"
-      :label="t('showAllLabel')"
-      color="primary"
-      density="compact"
-    />
-
-    <template v-if="availablePluginsFetch.loading.value">
-      <v-skeleton-loader
-        v-for="n in 4"
-        :key="n"
-        :class="$vuetify.theme.current.dark ? 'my-4' : 'my-4 skeleton'"
-        :height="100"
-        type="list-item-two-line"
-      />
-    </template>
-
-    <v-card
-      v-for="result in filteredAvailablePlugins"
-      v-else
-      :key="'available-' + result.id"
-      :loading="pluginLocked === `${result.id}` ? 'primary' : false"
-      class="mb-4"
-    >
-      <v-toolbar
-        :title="result.distTag === 'latest' ? result.name : result.name + ' (' + result.distTag + ')'"
-        density="compact"
-        flat
-      >
-        <template #append>
-          {{ result.version }}
-          <v-btn
-            :disabled="!!pluginLocked"
-            :icon="mdiDownload"
-            :title="t('install')"
-            color="primary"
-            @click="install.execute(result)"
-          />
-        </template>
-      </v-toolbar>
-      <v-card-text
-        v-if="result.description"
-        class="py-2"
-      >
-        <p class="mb-0">
-          {{ result.description }}
-        </p>
-      </v-card-text>
-    </v-card>
-  </v-container>
-</template>
-
-<script setup lang="ts">
-import SearchField from '@data-fair/lib-vuetify/search-field.vue'
-import Vjsf, { type Options as VjsfOptions } from '@koumoul/vjsf'
-import { v2compat } from '@koumoul/vjsf/compat/v2'
-import { compare, gt, major } from 'semver'
-
-const { t } = useI18n()
-const session = useSession()
-const search = useStringSearchParam('q')
-const query = ref({ showAll: false })
-const valid = ref<Record<string, boolean>>({})
-
-if (!session.state.user) throw new Error(t('authRequired'))
-if (!session.state.user?.adminMode) throw new Error(t('adminRequired'))
-setBreadcrumbs([{ text: t('pluginsBreadcrumb') }])
-
-type AvailablePlugin = {
-  id?: string // Calculated from name version and distTag
-  name: string
-  description?: string
-  distTag: string
-  version: string
-}
-
-type InstalledPlugin = {
-  usages: number
-  name: string
-  description: string
-  distTag: string
-  version: string
-  id: string
-  config: Record<string, any>
-  access: Record<string, any>
-  metadata: Record<string, any>
-  pluginConfigSchema: Record<string, any>
-  pluginMetadataSchema: Record<string, any>
-}
-
-const installedPluginsFetch = useFetch<{
-  results: InstalledPlugin[],
-  facets: { usages: Record<string, number> },
-  count: number
-}>(`${$apiPath}/plugins`)
-
-/** Build a stable key for grouping plugins by name and dist tag. */
-const pluginKey = (name: string, distTag: string) => `${name}::${distTag}`
-
-const availablePluginsFetch = useFetch<{
-  results: AvailablePlugin[],
-  count: number
-}>(`${$apiPath}/plugins-registry`, { query: query.value })
-
-/** Sort registry plugins and inject computed ids (immutable). */
-const availablePlugins = computed(() =>
-  (availablePluginsFetch.data.value?.results || [])
-    .map(r => ({ ...r, id: generatePluginId(r.name, r.version, r.distTag) }))
-    .sort((a, b) => a.name.localeCompare(b.name) || a.version.localeCompare(b.version))
-)
-
-const showDeleteMenu = ref(null) as Ref<string | null>
-const showMajorUpdateMenu = ref(null) as Ref<string | null>
-const showManualInstallMenu = ref<boolean>(false)
-const pluginLocked = ref(null) as Ref<string | null>
-const manualInstallPlugin = ref<AvailablePlugin>({ name: '', version: '', distTag: 'latest' })
-const selectedFile = ref<File>()
-
-/** Fast lookup of available plugins by key. */
-const availableByKey = computed(() => {
-  const map = new Map<string, AvailablePlugin>()
-  for (const plugin of availablePlugins.value) {
-    map.set(pluginKey(plugin.name, plugin.distTag), plugin)
-  }
-  return map
-})
-
-/** Assign usage count and normalize schema for VJSF v3. */
-const installedPlugins = computed(() => {
-  const results = installedPluginsFetch.data.value?.results || []
-  const usages = installedPluginsFetch.data.value?.facets.usages || {}
-  return results.map(r => ({
-    ...r,
-    pluginConfigSchema: v2compat(r.pluginConfigSchema),
-    usages: usages[r.id] || 0
-  }))
-})
-
-/** Keep the latest installed version per plugin key. */
-const latestInstalledByKey = computed(() => {
-  const map = new Map<string, InstalledPlugin>()
-  for (const plugin of installedPlugins.value) {
-    const key = pluginKey(plugin.name, plugin.distTag)
-    const current = map.get(key)
-    if (!current || compare(plugin.version, current.version) > 0) {
-      map.set(key, plugin)
-    }
-  }
-  return map
-})
-
-const noUpdate = { available: false, version: '', isMajor: false } as const
-
-/** Precompute update availability for each installed plugin. */
-const updateInfoById = computed(() => {
-  const info: Record<string, { available: boolean, version: string, isMajor: boolean }> = {}
-  for (const plugin of installedPlugins.value) {
-    const key = pluginKey(plugin.name, plugin.distTag)
-    const latestInstalled = latestInstalledByKey.value.get(key)
-    const available = availableByKey.value.get(key)
-
-    if (!latestInstalled || !available || latestInstalled.id !== plugin.id || !gt(available.version, latestInstalled.version)) {
-      info[plugin.id] = noUpdate
-      continue
-    }
-
-    info[plugin.id] = {
-      available: true,
-      version: available.version,
-      isMajor: major(available.version) > major(latestInstalled.version)
-    }
-  }
-  return info
-})
-
-/** Match a plugin name or description against the current search term. */
-const matchesSearch = (r: { name: string, description?: string }) =>
-  !search.value || r.name.includes(search.value) || (r.description && r.description.includes(search.value))
-
-/** Filter installed plugins by search term. */
-const filteredInstalledPlugins = computed(() => installedPlugins.value.filter(matchesSearch))
-
-/** Pre-computed sets for fast installed plugin lookups. */
-const installedIds = computed(() => new Set(installedPlugins.value.map(r => r.id)))
-const installedByNameTag = computed(() => {
-  const map = new Map<string, number>()
-  for (const r of installedPlugins.value) {
-    const key = pluginKey(r.name, r.distTag)
-    const current = map.get(key)
-    if (current === undefined || major(r.version) > current) map.set(key, major(r.version))
-  }
-  return map
-})
-
-/** Filter registry plugins by search term, excluding already installed ones and major upgrades of installed ones. */
-const filteredAvailablePlugins = computed(() =>
-  availablePlugins.value.filter(r => {
-    if (installedIds.value.has(r.id)) return false
-    const installedMajor = installedByNameTag.value.get(pluginKey(r.name, r.distTag))
-    if (installedMajor !== undefined && major(r.version) > installedMajor) return false
-    return matchesSearch(r)
-  })
-)
-
-/** Detect whether any npm fields are filled for manual install. */
-const hasNpmFields = computed(() =>
-  !!(manualInstallPlugin.value.name?.trim() || manualInstallPlugin.value.version?.trim())
-)
-
-/** Ensure enough info is provided to install manually. */
-const canForceInstall = computed(() => {
-  if (hasNpmFields.value) return manualInstallPlugin.value.name && manualInstallPlugin.value.version && manualInstallPlugin.value.distTag
-  if (selectedFile.value) return true
-  return false
-})
-
-/** Reset manual install form state. */
-const resetManualInstallFrom = () => {
-  showManualInstallMenu.value = false
-  manualInstallPlugin.value = { name: '', version: '', distTag: 'latest' }
-  selectedFile.value = undefined
-}
-
-/** Build a stable plugin id from name, major version and dist tag. */
-const generatePluginId = (name: string, version: string, distTag: string) => {
-  let id = name.replace('/', '-') + '-' + major(version)
-  if (distTag && distTag !== 'latest') id += '-' + distTag
-  return id
-}
-
-/** Install a plugin from registry or a local tgz file. */
-const install = useAsyncAction(
-  async (plugin?: AvailablePlugin) => {
-    if (!canForceInstall.value && !plugin) return
-
-    let body: FormData | AvailablePlugin
-
-    // From a file
-    if (selectedFile.value) {
-      body = new FormData()
-      body.append('file', selectedFile.value)
-
-      // From npm registry
-    } else {
-      const pluginPost = plugin || manualInstallPlugin.value
-      pluginLocked.value = `${pluginPost.id || generatePluginId(pluginPost.name, pluginPost.version, pluginPost.distTag)}`
-      body = {
-        name: pluginPost.name,
-        version: pluginPost.version,
-        distTag: pluginPost.distTag
-      }
-    }
-
-    await $fetch('/plugins', {
-      method: 'POST',
-      body
-    })
-    installedPluginsFetch.refresh()
-    pluginLocked.value = null
-    resetManualInstallFrom()
-  },
-  {
-    error: t('installError'),
-    success: t('installSuccess')
-  }
-)
-
-/** Uninstall a plugin by id. */
-const uninstall = useAsyncAction(
-  async (plugin: InstalledPlugin) => {
-    pluginLocked.value = `${plugin.name}-${plugin.distTag}`
-    await $fetch(`/plugins/${plugin.id}`, {
-      method: 'DELETE'
-    })
-    installedPluginsFetch.refresh()
-    pluginLocked.value = null
-    showDeleteMenu.value = null
-  },
-  {
-    error: t('uninstallError'),
-    success: t('uninstallSuccess')
-  }
-)
-
-/** Install the latest available version of a plugin (minor update or new major). */
-const update = async (plugin: InstalledPlugin) => {
-  const availablePlugin = availablePlugins.value.find(r => r.name === plugin.name && r.distTag === plugin.distTag)
-  if (!availablePlugin) return
-  await install.execute(availablePlugin)
-}
-
-/** Persist config/access/metadata changes for a plugin. */
-const save = async (plugin: InstalledPlugin, type: 'config' | 'access' | 'metadata') => {
-  pluginLocked.value = `${plugin.name}-${plugin.distTag}`
-  await $fetch(`/plugins/${plugin.id}/${type}`, {
-    method: 'PUT',
-    body: plugin[type]
-  })
-  pluginLocked.value = null
-}
-
-/** Shared VJSF options for schema-driven forms. */
-const vjsfOptions = computed<VjsfOptions>(() => ({
-  density: 'compact',
-  initialValidation: 'always',
-  locale: session.lang.value,
-  titleDepth: 4,
-  updateOn: 'blur',
-  xI18n: true
-}))
-
-</script>
-
-<i18n lang="yaml">
-en:
-  adminRequired: You do not have permission to access this page, you need to enable super-admin mode.
-  authRequired: Authentication required
-  availablePluginsLabel: available plugins
-  cancel: Cancel
-  install: Install
-  installError: Error while installing the plugin
-  installSeparately: Install separately
-  installSuccess: Plugin installed!
-  installedPluginsLabel: installed plugins
-  majorInstallBody: Installing a major version will create a separate entry. Existing processings will continue to use the current version.
-  majorInstallTitleWithVersions: Major version installation
-  manualInstall: Install a plugin manually
-  manualInstallDistTag: Distribution tag
-  manualInstallFileLabel: Select a .tgz file
-  manualInstallFromFile: Install from a file
-  manualInstallFromNpm: Install from npm
-  manualInstallName: Plugin name
-  manualInstallTitle: Manual plugin installation
-  manualInstallVersion: Plugin version
-  no: No
-  pluginsBreadcrumb: Plugins
-  showAllLabel: Show test versions of plugins
-  uninstall: Uninstall
-  uninstallConfirm: Are you sure you want to uninstall the plugin "{name}"?
-  uninstallError: Error while uninstalling the plugin
-  uninstallSuccess: Plugin uninstalled!
-  uninstallTitle: Uninstall plugin
-  update: Update
-  updateWithVersion: Update ({version})
-  usageCount: Used {count} times
-  yes: Yes
-
-fr:
-  adminRequired: Vous n'avez pas la permission d'accéder à cette page, il faut avoir activé le mode super-administration.
-  authRequired: Authentification nécessaire
-  availablePluginsLabel: plugins disponibles
-  cancel: Annuler
-  install: Installer
-  installError: Erreur lors de l'installation du plugin
-  installSeparately: Installer séparément
-  installSuccess: Plugin installé !
-  installedPluginsLabel: plugins installés
-  majorInstallBody: L'installation d'une version majeure créera une entrée séparée. Les traitements existants continueront d'utiliser la version actuelle.
-  majorInstallTitleWithVersions: Installation d'une version majeure
-  manualInstall: Installer un plugin manuellement
-  manualInstallDistTag: Tag de distribution
-  manualInstallFileLabel: Sélectionner un fichier .tgz
-  manualInstallFromFile: Installer depuis un fichier
-  manualInstallFromNpm: Installer depuis npm
-  manualInstallName: Nom du plugin
-  manualInstallTitle: Installation manuelle d'un plugin
-  manualInstallVersion: Version du plugin
-  no: Non
-  pluginsBreadcrumb: Plugins
-  showAllLabel: Afficher les versions de test des plugins
-  uninstall: Désinstaller
-  uninstallConfirm: Voulez-vous vraiment désinstaller le plugin "{name}" ?
-  uninstallError: Erreur lors de la désinstallation du plugin
-  uninstallSuccess: Plugin désinstallé !
-  uninstallTitle: Désinstallation du plugin
-  update: Mettre à jour
-  updateWithVersion: Mettre à jour ({version})
-  usageCount: Utilisé {count} fois
-  yes: Oui
-</i18n>
diff --git a/ui/src/pages/dev.vue b/ui/src/pages/dev.vue
index 2ba33140..ab47df94 100644
--- a/ui/src/pages/dev.vue
+++ b/ui/src/pages/dev.vue
@@ -7,13 +7,6 @@
       >
         Traitements
       </v-btn>
-      <v-btn
-        variant="text"
-        href="/processings/admin/plugins"
-        color="admin"
-      >
-        Plugins
-      </v-btn>
       <v-btn
         variant="text"
         target="_blank"
diff --git a/ui/src/pages/processings/[id]/index.vue b/ui/src/pages/processings/[id]/index.vue
index a5cd588b..cc9a09d6 100644
--- a/ui/src/pages/processings/[id]/index.vue
+++ b/ui/src/pages/processings/[id]/index.vue
@@ -3,6 +3,17 @@
     v-if="processing"
     data-iframe-height
   >
+    <v-alert
+      v-if="pluginBroken"
+      type="error"
+      variant="tonal"
+      class="mb-4"
+      :title="t('pluginUnavailableTitle')"
+    >
+      {{ t('pluginUnavailableBody') }}
+      <br>
+      <code>{{ processing?.plugin }}</code>
+    </v-alert>
     <h2 class="text-headline-small">
       {{ t('processingTitle', { title: processing.title }) }}
     </h2>
@@ -25,7 +36,7 @@
         autocomplete="off"
       >
         <vjsf
-          v-if="processingSchema"
+          v-if="processingSchema && !pluginBroken"
           v-model="editProcessing"
           :schema="processingSchema"
           :options="vjsfOptions"
@@ -34,7 +45,7 @@
           <template #activity>
             <processing-activity
               :processing="Object.assign(processing, editProcessing)"
-              :plugin-title="plugin?.metadata.name"
+              :plugin-title="plugin?.title?.fr ?? plugin?.title?.en ?? plugin?.name"
             />
           </template>
           <template #scheduling-summary="{ node }">
@@ -60,7 +71,8 @@
         :can-exec="canExecProcessing"
         :edited="edited"
         :is-small="false"
-        :metadata="plugin?.metadata"
+        :documentation="plugin?.documentation"
+        :plugin-broken="pluginBroken"
         @triggered="runs && runs.refresh()"
       />
     </navigation-right>
@@ -68,8 +80,10 @@
 </template>
 
 <script setup lang="ts">
-import type { Plugin, Processing } from '#api/types'
+import type { Processing } from '#api/types'
+import type { RegistryArtefact } from '~/composables/use-plugin-fetch'
 
+import { ofetch } from 'ofetch'
 import cronstrue from 'cronstrue'
 import 'cronstrue/locales/en'
 import 'cronstrue/locales/fr'
@@ -97,7 +111,9 @@ const valid = ref(false)
 const edited = ref(false)
 const editProcessing: Ref<Processing | null> = ref(null)
 const processing: Ref<Processing | null> = ref(null)
-const plugin: Ref<Plugin | null> = ref(null)
+const plugin: Ref<RegistryArtefact | null> = ref(null)
+const pluginBroken = ref(false)
+const configSchema: Ref<Record<string, unknown> | null> = ref(null)
 const runs: Ref<Record<string, any>> = ref([])
 
 /*
@@ -120,9 +136,42 @@ async function fetchProcessing () {
   if (processing.value) editProcessing.value = { ...processing.value }
 }
 async function fetchPlugin () {
-  if (processing.value?.plugin) {
-    plugin.value = await $fetch(`/plugins/${processing.value.plugin}`)
+  pluginBroken.value = false
+  if (!processing.value?.plugin) return
+  // Display metadata comes from registry — `processing.plugin` is the artefact id.
+  // The config schema is read out of the cached package.json by the
+  // processings API — registry doesn't know or care what's inside packages.
+  //
+  // Registry returns 404 when the plugin has been deleted, 403 when the
+  // owner has lost access. We collapse both into pluginBroken=true and
+  // render a banner; the config-schema fetch's 404 (no schema for this
+  // plugin) is a separate, narrower state that does NOT trigger the banner.
+  //
+  // Hit the registry with the bare `ofetch` — not the app's `$fetch`, whose
+  // `/processings/api/v1` baseURL would rewrite this to
+  // `/processings/api/v1/registry/...` and 404. Registry is mounted at
+  // `/registry` of the current domain (same convention as use-plugin-fetch).
+  const artefactResult = await ofetch<RegistryArtefact>(
+    `/registry/api/v1/artefacts/${encodeURIComponent(processing.value.plugin)}`
+  ).then(
+    (data) => ({ ok: true as const, data }),
+    (err) => {
+      const status = err?.statusCode ?? err?.status
+      if (status === 404 || status === 403) return { ok: false as const }
+      throw err
+    }
+  )
+  if (!artefactResult.ok) {
+    pluginBroken.value = true
+    return
   }
+  plugin.value = artefactResult.data
+  configSchema.value = await $fetch<Record<string, unknown>>(
+    `/processings/${processingId}/plugin-config-schema`
+  ).catch(err => {
+    if (err?.statusCode === 404 || err?.status === 404) return null
+    throw err
+  })
 }
 
 /*
@@ -144,19 +193,21 @@ const canExecProcessing = computed(() => {
 
 const processingSchema = computed(() => {
   if (!plugin.value || !processing.value) return
+  const pluginConfigSchema = configSchema.value as any
+  if (!pluginConfigSchema) return
   const schema = JSON.parse(JSON.stringify(contractProcessing))
   schema.properties.config = {
-    ...v2compat(plugin.value.processingConfigSchema),
-    title: 'Plugin ' + plugin.value.metadata.name,
+    ...v2compat(pluginConfigSchema),
+    title: 'Plugin ' + (plugin.value.title?.fr ?? plugin.value.title?.en ?? plugin.value.name)
   }
 
   // merge processingConfigSchema $defs and definitions into the global Processing schema
-  if (plugin.value.processingConfigSchema.$defs) {
-    schema.$defs = { ...schema.$defs, ...plugin.value.processingConfigSchema.$defs }
+  if (pluginConfigSchema.$defs) {
+    schema.$defs = { ...schema.$defs, ...pluginConfigSchema.$defs }
     delete schema.properties.config.$defs
   }
-  if (plugin.value.processingConfigSchema.definitions) {
-    schema.definitions = { ...schema.definitions, ...plugin.value.processingConfigSchema.definitions }
+  if (pluginConfigSchema.definitions) {
+    schema.definitions = { ...schema.definitions, ...pluginConfigSchema.definitions }
     delete schema.properties.config.definitions
   }
   delete schema.properties.config.$id
@@ -264,6 +315,8 @@ const timezoneLabel = (timeZone: string) => {
     search: 'Search...'
     timezone: 'Timezone:'
     updateError: Error while updating the processing
+    pluginUnavailableTitle: Plugin unavailable
+    pluginUnavailableBody: This processing's plugin has been removed or its access revoked. You can no longer edit or run this processing, but you can still view its run history and delete it.
 
   fr:
     frequency:
@@ -276,6 +329,8 @@ const timezoneLabel = (timeZone: string) => {
     search: 'Rechercher...'
     timezone: 'Fuseau horaire :'
     updateError: Erreur lors de la mise à jour du traitement
+    pluginUnavailableTitle: Plugin indisponible
+    pluginUnavailableBody: Le plugin de ce traitement a été supprimé ou son accès retiré. Vous ne pouvez plus modifier ni exécuter ce traitement, mais vous pouvez consulter son historique et le supprimer.
 
 </i18n>
 
diff --git a/ui/src/pages/processings/new.vue b/ui/src/pages/processings/new.vue
index 2ed2502d..eba65c86 100644
--- a/ui/src/pages/processings/new.vue
+++ b/ui/src/pages/processings/new.vue
@@ -29,46 +29,66 @@
 
       <v-stepper-window>
         <v-stepper-window-item value="1">
+          <v-text-field
+            v-model="search"
+            :label="t('searchPlugin')"
+            density="compact"
+            variant="outlined"
+            clearable
+            class="mb-4"
+            hide-details
+            prepend-inner-icon="mdi-magnify"
+          />
           <div
-            v-for="category in orderedCategories"
-            :key="category"
+            v-for="group in orderedGroups"
+            :key="group"
             class="mb-4"
           >
-            <template v-if="categorizedPlugins[category]?.length">
-              <h3>{{ category }}</h3>
+            <template v-if="groupedArtefacts[group]?.length">
+              <h3 class="text-h6 mb-2">
+                {{ group }}
+              </h3>
               <v-row class="d-flex align-stretch">
                 <v-col
-                  v-for="plugin in categorizedPlugins[category]"
-                  :key="plugin.id"
+                  v-for="artefact in groupedArtefacts[group]"
+                  :key="artefact._id"
                   md="3"
                   sm="4"
                   cols="12"
                 >
                   <v-card
                     class="h-100"
-                    :color="newProcessing.plugin === plugin.id ? 'primary' : ''"
-                    @click="newProcessing.plugin = plugin.id; step = '2'"
+                    :color="isPicked(artefact) ? 'primary' : ''"
+                    @click="pickPlugin(artefact)"
                   >
                     <template #title>
-                      <span :class="newProcessing.plugin !== plugin.id ? 'text-primary' : ''">
-                        {{ plugin.metadata.name }}
+                      <span :class="!isPicked(artefact) ? 'text-primary' : ''">
+                        {{ artefactDisplayName(artefact) }}
                       </span>
                     </template>
                     <template
-                      v-if="plugin.metadata.icon"
+                      v-if="artefact.thumbnail"
                       #prepend
                     >
-                      <v-icon
-                        :color="newProcessing.plugin !== plugin.id ? 'primary' : ''"
-                        :icon="plugin.metadata.icon.svgPath"
+                      <v-avatar
+                        size="32"
+                        :image="`/registry/api/v1/thumbnails/${artefact.thumbnail.id}/data`"
                       />
                     </template>
-                    <v-card-text>{{ plugin.metadata.description }}</v-card-text>
+                    <v-card-text>{{ artefactDisplayDescription(artefact) }}</v-card-text>
                   </v-card>
                 </v-col>
               </v-row>
             </template>
           </div>
+          <v-alert
+            v-if="!filteredArtefacts.length && !installedPluginsFetch.loading.value"
+            type="info"
+            variant="tonal"
+            class="mt-4"
+          >
+            {{ search ? t('noMatch') : t('noPlugins') }}
+          </v-alert>
         </v-stepper-window-item>
         <v-stepper-window-item value="2">
           <v-text-field
@@ -107,23 +127,30 @@
 <script setup lang="ts">
 import OwnerPick from '@data-fair/lib-vuetify/owner-pick.vue'
 
-type InstalledPlugin = {
+// Subset of registry's Artefact shape that the picker actually uses. Kept
+// inline to avoid importing the registry types into processings. The
+// artefact `_id` is the registry artefact id, stored directly as
+// `processing.plugin`.
+type RegistryArtefact = {
+  _id: string
   name: string
-  description: string
-  version: string
-  distTag: string
-  id: string
-  pluginConfigSchema: any
-  processingConfigSchema: any
-  metadata: {
-    name: string
-    description: string
-    category: string
-    icon: Record<string, string>
-  }
+  format?: 'npm' | 'file'
+  category: string
+  title?: { fr?: string, en?: string }
+  description?: { fr?: string, en?: string }
+  group?: { fr?: string, en?: string }
+  thumbnail?: { id: string, width: number, height: number }
 }
 
-const { t } = useI18n()
+const pluginForArtefact = (a: RegistryArtefact): string => a._id
+
+type NewProcessing = {
+  title?: string
+  owner?: { type: 'user' | 'organization', id: string, department?: string }
+  plugin?: string
+}
+
+const { t, locale } = useI18n()
 const session = useSessionAuthenticated(() => new Error('Authentification nécessaire'))
 const router = useRouter()
 
@@ -139,7 +166,6 @@ const owner = computed(() => {
     return session.state.account
   }
 })
-const ownerFilter = computed(() => `${owner.value.type}:${owner.value.id}${owner.value.department ? ':' + owner.value.department : ''}`)
 const ownerRole = computed(() => {
   const user = session.state.user
   if (owner.value.type === 'user') {
@@ -157,27 +183,59 @@ const ownerRole = computed(() => {
 const canAdmin = computed(() => ownerRole.value === 'admin' || !!session.state.user?.adminMode)
 if (!canAdmin.value) throw new Error(t('noPermission'))
 
-const installedPluginsFetch = useFetch<{ results: InstalledPlugin[], count: number }>(`${$apiPath}/plugins?privateAccess=${ownerFilter.value}`)
-const installedPlugins = computed(() => installedPluginsFetch.data.value?.results)
+// Registry sits on the same domain at /registry — same-origin call, the
+// SimpleDirectory session cookie is sent automatically. Filtered server-side
+// to processing-category artefacts the calling account can see.
+const installedPluginsFetch = useFetch<{ results: RegistryArtefact[], count: number }>(
+  '/registry/api/v1/artefacts',
+  { query: { category: 'processing', size: 100 } }
+)
+const installedPlugins = computed(() => installedPluginsFetch.data.value?.results ?? [])
+
+const search = ref('')
+const filteredArtefacts = computed(() => {
+  const q = search.value?.trim().toLowerCase()
+  if (!q) return installedPlugins.value
+  return installedPlugins.value.filter(a =>
+    a.name.toLowerCase().includes(q) ||
+    artefactDisplayName(a).toLowerCase().includes(q) ||
+    (artefactDisplayDescription(a) ?? '').toLowerCase().includes(q)
+  )
+})
+
+const artefactDisplayName = (a: RegistryArtefact) =>
+  a.title?.[locale.value as 'fr' | 'en'] ?? a.title?.fr ?? a.title?.en ?? a.name
+const artefactDisplayDescription = (a: RegistryArtefact) =>
+  a.description?.[locale.value as 'fr' | 'en'] ?? a.description?.fr ?? a.description?.en ?? ''
+const artefactGroup = (a: RegistryArtefact) =>
+  a.group?.[locale.value as 'fr' | 'en'] ?? a.group?.fr ?? a.group?.en ?? t('otherGroup')
+
+// Configured group order, with a trailing fallback bucket for ungrouped or
+// unknown groups. Empty buckets are hidden by the template.
+const orderedGroups = computed(() => [...$uiConfig.pluginCategories, t('otherGroup')])
+const groupedArtefacts = computed(() => {
+  const buckets: Record<string, RegistryArtefact[]> = {}
+  for (const group of orderedGroups.value) buckets[group] = []
+  for (const artefact of filteredArtefacts.value) {
+    const group = artefactGroup(artefact)
+    if (!buckets[group]) buckets[group] = []
+    buckets[group].push(artefact)
+  }
+  return buckets
+})
 
 const step = ref('1')
 const showCreateMenu = ref(false)
-const newProcessing: Ref<Record<string, string>> = ref({})
+const newProcessing = ref<NewProcessing>({})
 const ownersReady = ref(false)
 
-const orderedCategories = [...$uiConfig.pluginCategories, t('others')]
-const categorizedPlugins = computed(() => {
-  const categories: Record<string, InstalledPlugin[]> = {}
-  orderedCategories.forEach(category => {
-    categories[category] = []
-  })
-  installedPlugins.value?.forEach(plugin => {
-    const category = plugin.metadata.category || t('others')
-    if (!categories[category]) categories[category] = []
-    categories[category].push(plugin)
-  })
-  return categories
-})
+const pickPlugin = (artefact: RegistryArtefact) => {
+  newProcessing.value.plugin = pluginForArtefact(artefact)
+  step.value = '2'
+}
+const isPicked = (artefact: RegistryArtefact) =>
+  newProcessing.value.plugin !== undefined &&
+  newProcessing.value.plugin === pluginForArtefact(artefact)
 
 const createProcessing = useAsyncAction(
   async () => {
@@ -214,11 +272,14 @@ onMounted(() => {
     previous: Previous
     create: Create
     noPermission: You do not have permission to create a processing
-    others: Others
+    searchPlugin: Search for a plugin
+    noPlugins: No processing plugins are available for this account.
+    noMatch: No plugin matches your search.
     createSuccess: Processing created!
     createError: Error while creating processing
     processings: Processings
     createProcessing: Create a processing
+    otherGroup: Other
 
   fr:
     selectPluginType: Sélection du type de traitement
@@ -227,11 +288,14 @@ onMounted(() => {
     previous: Précédent
     create: Créer
     noPermission: Vous n'avez pas les droits pour créer un traitement
-    others: Autres
+    searchPlugin: Rechercher un plugin
+    noPlugins: Aucun plugin de traitement n'est disponible pour ce compte.
+    noMatch: Aucun plugin ne correspond à votre recherche.
     createSuccess: Traitement créé !
     createError: Erreur lors de la création du traitement
     processings: Traitements
     createProcessing: Créer un traitement
+    otherGroup: Autres
 
 </i18n>
 
diff --git a/upgrade/5.2.0/01-publish-plugins-to-registry.ts b/upgrade/5.2.0/01-publish-plugins-to-registry.ts
new file mode 100644
index 00000000..7a49d8f4
--- /dev/null
+++ b/upgrade/5.2.0/01-publish-plugins-to-registry.ts
@@ -0,0 +1,425 @@
+import type { UpgradeScript } from '@data-fair/lib-node/upgrade-scripts.js'
+import { existsSync, createReadStream, createWriteStream } from 'node:fs'
+import { readdir, readFile, stat, lstat, readlink, mkdtemp, rm } from 'node:fs/promises'
+import path from 'node:path'
+import os from 'node:os'
+import { arch as hostArch } from 'node:process'
+import { createGzip } from 'node:zlib'
+import { pipeline } from 'node:stream/promises'
+import * as tarStream from 'tar-stream'
+import axios, { type AxiosInstance } from 'axios'
+import * as mdi from '@mdi/js'
+import config from '../../worker/src/config.ts'
+
+// Convert a legacy v5 mdi icon name (e.g. `mdi-database`, `mdiDatabase`,
+// `database`) into its @mdi/js export name `mdiDatabase`. Returns null if
+// the input doesn't resolve to a known icon.
+const resolveMdiPath = (icon: string): string | null => {
+  const trimmed = icon.trim()
+  if (!trimmed) return null
+  const stripped = trimmed.replace(/^mdi[-_]?/i, '')
+  const camel = 'mdi' + stripped
+    .split(/[-_]/)
+    .filter(Boolean)
+    .map(part => part.charAt(0).toUpperCase() + part.slice(1))
+    .join('')
+  const path = (mdi as unknown as Record<string, unknown>)[camel]
+  return typeof path === 'string' ? path : null
+}
+
+// Render a 256×256 SVG wrapping an mdi path: a dark-grey glyph over a white
+// rounded-corner square so the thumbnail reads cleanly against any UI
+// background. The glyph (native 24×24) is scaled to 60% and centred, leaving a
+// generous margin inside the square. Larger than 24 so the registry's
+// sharp-based thumbnail resize (target 400 px wide) gets a clean rasterization.
+// Deliberately bare — no `<?xml?>` prologue, no `<!DOCTYPE>`: libvips/librsvg
+// chokes on (or tries to fetch) the external SVG 1.1 DTD that v5's stored
+// `svg` blobs carry.
+const renderMdiSvg = (mdiPath: string): string =>
+  `<svg xmlns="http://www.w3.org/2000/svg" width="256" height="256" viewBox="0 0 24 24"><rect width="24" height="24" rx="4" fill="#ffffff"/><g transform="translate(4.8 4.8) scale(0.6)"><path d="${mdiPath}" fill="#424242"/></g></svg>`
+
+// Pull the first `<path d="...">` out of an arbitrary SVG string.
+const pathFromSvg = (svg: string): string | null => {
+  const m = svg.match(/<path[^>]*\sd="([^"]+)"/i)
+  return m ? m[1] : null
+}
+
+// v5 stored icons in `-metadata.json` as either an mdi name string OR an
+// object `{ svg, svgPath, name }` (post-overhaul). We always re-wrap the path
+// data in our own clean 256×256 template — never pass v5's `svg` blob through,
+// since its XML prologue / external DOCTYPE can hang or crash libvips.
+const extractIconSvg = (icon: unknown): string | null => {
+  if (typeof icon === 'string' && icon.trim()) {
+    const p = resolveMdiPath(icon)
+    return p ? renderMdiSvg(p) : null
+  }
+  if (icon && typeof icon === 'object') {
+    const obj = icon as { svg?: unknown, svgPath?: unknown, name?: unknown }
+    if (typeof obj.svgPath === 'string' && obj.svgPath.trim()) return renderMdiSvg(obj.svgPath)
+    if (typeof obj.name === 'string' && obj.name.trim()) {
+      const p = resolveMdiPath(obj.name)
+      if (p) return renderMdiSvg(p)
+    }
+    if (typeof obj.svg === 'string' && obj.svg.trim()) {
+      const p = pathFromSvg(obj.svg)
+      if (p) return renderMdiSvg(p)
+    }
+  }
+  return null
+}
+
+/**
+ * v6.0 first-boot migration — step 1/2.
+ *
+ * For each plugin still living on the legacy `dataDir/plugins` volume:
+ *   1. repack the directory (including `node_modules`) and upload the tarball
+ *      to registry, tagged with the host architecture
+ *   2. push the legacy companion files into registry:
+ *      - `-metadata.json` → registry artefact `title.fr`, `description.fr`,
+ *        `group.fr` (from v5 `category`), `documentation` via PATCH /artefacts/:id
+ *      - `-access.json`   → registry artefact `public` + `privateAccess` via
+ *        the same PATCH, and one POST /access-grants per privateAccess entry
+ *      - `metadata.icon`  → rendered to a 256×256 SVG using @mdi/js and posted
+ *        to the artefact's thumbnail endpoint. Unknown icon names are logged
+ *        and skipped (operator can upload a custom thumbnail later).
+ *
+ * Idempotent:
+ *  - the publish step probes registry first and skips any (name, version,
+ *    arch) tuple that is already published
+ *  - PATCH replaces fields wholesale and POST /access-grants accepts 409 when
+ *    the grant already exists
+ *
+ * distTag-suffixed plugin dirs (i.e. installed under a non-`latest` distTag)
+ * are skipped with a warning — registry has no distTag concept, so the
+ * operator must republish them under a distinct artefact name manually. A
+ * processing referencing an unpublished plugin surfaces as a broken plugin
+ * in the UI.
+ *
+ * Concurrency: relies on the upgrade-scripts mongo lock; only one worker pod
+ * runs this at a time.
+ */
+
+type PluginManifest = { name: string, version: string, distTag?: string }
+
+async function listLegacyPluginDirs (pluginsDir: string, debug: (msg: string) => void): Promise<string[]> {
+  const entries = await readdir(pluginsDir, { withFileTypes: true })
+  const dirs: string[] = []
+  for (const entry of entries) {
+    if (entry.name.endsWith('.json')) continue
+    if (entry.isDirectory()) {
+      dirs.push(entry.name)
+      continue
+    }
+    if (entry.isSymbolicLink()) {
+      // Follow the link only enough to confirm it points to an actual directory.
+      // Broken or non-dir symlinks are skipped — they show up in legacy volumes
+      // when a plugin was renamed (e.g. unscoped → @scope) and a stale link
+      // was left behind.
+      try {
+        const s = await stat(path.join(pluginsDir, entry.name))
+        if (s.isDirectory()) dirs.push(entry.name)
+        else debug(`${entry.name}: symlink to non-directory, skipping`)
+      } catch (err: any) {
+        debug(`${entry.name}: broken symlink (${err?.code ?? err?.message}), skipping`)
+      }
+      continue
+    }
+    debug(`${entry.name}: not a directory, skipping`)
+  }
+  return dirs
+}
+
+async function readPluginManifest (pluginsDir: string, dir: string, debug: (msg: string) => void): Promise<PluginManifest | null> {
+  const pluginJsonPath = path.join(pluginsDir, dir, 'plugin.json')
+  if (!existsSync(pluginJsonPath)) {
+    debug(`${dir}: no plugin.json, skipping`)
+    return null
+  }
+  const pluginJson = JSON.parse(await readFile(pluginJsonPath, 'utf-8')) as PluginManifest
+  const { name, version, distTag } = pluginJson
+  if (!name || !version) {
+    debug(`${dir}: malformed plugin.json (missing name or version), skipping`)
+    return null
+  }
+  if (distTag && distTag !== 'latest') {
+    debug(`${dir}: distTag "${distTag}" plugin — registry has no distTag concept, skipping. Operator must republish under a distinct artefact name.`)
+    return null
+  }
+  return pluginJson
+}
+
+// Read the published plugin's own package.json (under
+// `node_modules/<name>/package.json`) for the description/license/homepage
+// fields the v5 wrapper package.json doesn't carry. Returns {} on any failure
+// — those fields are nice-to-have, not critical for registry validation.
+async function readRealPluginPkg (pluginDir: string, name: string): Promise<{ description?: string, license?: string, homepage?: string }> {
+  try {
+    const realPkgPath = path.join(pluginDir, 'node_modules', ...name.split('/'), 'package.json')
+    const realPkg = JSON.parse(await readFile(realPkgPath, 'utf-8'))
+    const out: { description?: string, license?: string, homepage?: string } = {}
+    if (typeof realPkg.description === 'string') out.description = realPkg.description
+    if (typeof realPkg.license === 'string') out.license = realPkg.license
+    if (typeof realPkg.homepage === 'string') out.homepage = realPkg.homepage
+    return out
+  } catch {
+    return {}
+  }
+}
+
+// Pack a v5 plugin dir into a registry-shaped tarball.
+//
+// Substitutes a synthesized `package/package.json` carrying the plugin's real
+// name+version (from plugin.json) and `registry.category: "processing"` so
+// the registry's extractManifest accepts the upload. The original wrapper
+// package.json is dropped; everything else (index.js, plugin.json,
+// node_modules/...) is streamed verbatim. Symlinks are preserved as symlinks.
+async function packLegacyPlugin (pluginDir: string, manifest: PluginManifest, tarballPath: string): Promise<void> {
+  const realPkg = await readRealPluginPkg(pluginDir, manifest.name)
+  const synthesizedPkg: Record<string, unknown> = {
+    name: manifest.name,
+    version: manifest.version,
+    ...(realPkg.description ? { description: realPkg.description } : {}),
+    ...(realPkg.license ? { license: realPkg.license } : {}),
+    ...(realPkg.homepage ? { homepage: realPkg.homepage } : {}),
+    registry: { category: 'processing' }
+  }
+
+  const pack = tarStream.pack()
+  const writeDone = pipeline(pack, createGzip(), createWriteStream(tarballPath))
+
+  const addEntry = (header: tarStream.Headers, body?: string | Buffer): Promise<void> =>
+    new Promise<void>((resolve, reject) => {
+      const cb = (err?: Error | null) => err ? reject(err) : resolve()
+      if (body !== undefined) {
+        pack.entry(header, body, cb)
+        return
+      }
+      // symlinks (and any other non-file entry) carry no body — the linkname
+      // lives in the header. tar-stream hands back a "void" sink for these and
+      // throws "No body allowed for this entry" the moment any byte is written
+      // into it, so we must not pipe a file stream in.
+      if (header.type && header.type !== 'file' && header.type !== 'contiguous-file') {
+        pack.entry(header, cb).end()
+        return
+      }
+      const entry = pack.entry(header, cb)
+      // Forward stream-level failures (e.g. a file changing size mid-read) to
+      // the promise instead of letting an unhandled 'error' kill the process —
+      // the per-dir try/catch in exec() is meant to isolate a single bad plugin.
+      entry.on('error', reject)
+      createReadStream(path.join(pluginDir, header.name.replace(/^package\//, '')))
+        .on('error', reject)
+        .pipe(entry)
+    })
+
+  // Synthesized manifest first — registry's extractor matches the exact path.
+  await addEntry({ name: 'package/package.json' }, JSON.stringify(synthesizedPkg, null, 2))
+
+  const walk = async (relPath: string): Promise<void> => {
+    if (relPath === 'package.json') return // skip the v5 wrapper
+    const fullPath = path.join(pluginDir, relPath)
+    const st = await lstat(fullPath)
+    const tarName = `package/${relPath}`
+    if (st.isDirectory()) {
+      const children = await readdir(fullPath)
+      for (const child of children) {
+        await walk(`${relPath}/${child}`)
+      }
+    } else if (st.isFile()) {
+      await addEntry({ name: tarName, size: st.size, mode: st.mode, mtime: st.mtime, type: 'file' })
+    } else if (st.isSymbolicLink()) {
+      const target = await readlink(fullPath)
+      await addEntry({ name: tarName, type: 'symlink', linkname: target, mode: st.mode, mtime: st.mtime })
+    }
+    // sockets/devices/etc — not relevant for plugin tarballs, skip silently
+  }
+
+  for (const child of await readdir(pluginDir)) {
+    await walk(child)
+  }
+
+  pack.finalize()
+  await writeDone
+}
+
+function createRegistryClient (): AxiosInstance {
+  return axios.create({
+    baseURL: config.privateRegistryUrl.replace(/\/$/, ''),
+    headers: { 'x-secret-key': config.secretKeys.registry }
+  })
+}
+
+async function publishToRegistry (ax: AxiosInstance, pluginsDir: string, dir: string, manifest: PluginManifest, debug: (msg: string) => void): Promise<void> {
+  const { name, version } = manifest
+  // The artefact id is the legacy plugin directory name (the v5 id) — exactly
+  // what `processing.plugin` already references.
+  const artefactId = dir
+
+  // Probe: skip if (artefactId, arch) already in registry. The registry
+  // stores per-arch tarball slots inside `tarballs` on the artefact doc.
+  const probe = await ax.get(`/api/v1/artefacts/${encodeURIComponent(artefactId)}`, {
+    validateStatus: s => s === 200 || s === 404
+  })
+  if (probe.status === 200 && probe.data?.tarballs?.[hostArch]) {
+    debug(`${dir}: ${artefactId} (${hostArch}) already published, skipping`)
+    return
+  }
+
+  // Repack the dir into a gzipped tarball with the npm `package/` prefix.
+  // node_modules is included so lib-node consumers get a runnable bundle.
+  //
+  // The wrapper `package.json` v5 wrote (just `{ name, dependencies }`) is
+  // missing the `version` field that the registry's extractManifest requires.
+  // We synthesize a fresh `package/package.json` here from the plugin.json
+  // manifest plus the published plugin's own metadata (description, license)
+  // so registry validation passes and the artefact carries useful info.
+  // Everything else from the dir is streamed verbatim.
+  const stagingDir = await mkdtemp(path.join(os.tmpdir(), 'processings-migrate-'))
+  const tarballPath = path.join(stagingDir, `${dir}.tgz`)
+  try {
+    const pluginDir = path.join(pluginsDir, dir)
+    await packLegacyPlugin(pluginDir, manifest, tarballPath)
+
+    const form = new FormData()
+    form.append('architecture', hostArch)
+    // Backfill the artefact category for legacy plugin tarballs whose
+    // package.json predates the `registry.category` convention.
+    form.append('category', 'processing')
+    form.append('file', new Blob([await readFile(tarballPath)]), 'package.tgz')
+
+    debug(`${dir}: uploading ${name}@${version} as ${artefactId} (${hostArch}) to registry`)
+    await ax.post(`/api/v1/artefacts/npm/${encodeURIComponent(artefactId)}`, form, {
+      validateStatus: s => s === 201
+    }).catch((err) => {
+      const status = err?.response?.status
+      const body = err?.response?.data
+      const bodyStr = typeof body === 'string' ? body : JSON.stringify(body)
+      if (status === 409) {
+        throw new Error(`${dir}: artefact ${artefactId} is mirrored or claimed by another uploader (409). Reconcile manually before re-running. Registry said: ${bodyStr}`)
+      }
+      // Surface the registry's actual rejection reason — bare status codes
+      // ("Request failed with status code 400") are useless for operators.
+      if (status) {
+        throw new Error(`${dir}: registry rejected upload (${status}): ${bodyStr}`)
+      }
+      throw err
+    })
+    debug(`${dir}: published OK`)
+  } finally {
+    await rm(stagingDir, { recursive: true, force: true })
+  }
+}
+
+async function pushMetadataAndAccess (ax: AxiosInstance, pluginsDir: string, dir: string, debug: (msg: string) => void): Promise<void> {
+  const artefactId = dir
+
+  let metadata: Record<string, unknown> = {}
+  const metadataPath = path.join(pluginsDir, `${dir}-metadata.json`)
+  if (existsSync(metadataPath)) {
+    try { metadata = JSON.parse(await readFile(metadataPath, 'utf-8')) } catch { /* malformed, skip */ }
+  }
+  let access: { public?: boolean, privateAccess?: { type: string, id: string }[] } = { public: false, privateAccess: [] }
+  const accessPath = path.join(pluginsDir, `${dir}-access.json`)
+  if (existsSync(accessPath)) {
+    try { access = JSON.parse(await readFile(accessPath, 'utf-8')) } catch { /* malformed, treat as private */ }
+  }
+
+  const patch: Record<string, unknown> = {
+    public: !!access.public,
+    privateAccess: access.privateAccess ?? []
+  }
+  if (typeof metadata.name === 'string') patch.title = { fr: metadata.name }
+  if (typeof metadata.description === 'string') patch.description = { fr: metadata.description }
+  // v5 category was a free-string used to group plugins on the picker; the
+  // registry artefact's own `category` field is the artefact-kind discriminator
+  // (always "processing" here), so this maps to the new i18n `group.fr`.
+  if (typeof metadata.category === 'string') patch.group = { fr: metadata.category }
+  if (typeof metadata.documentation === 'string') patch.documentation = metadata.documentation
+
+  let updatedArtefact: { thumbnail?: unknown } | undefined
+  try {
+    const patchRes = await ax.patch(`/api/v1/artefacts/${encodeURIComponent(artefactId)}`, patch)
+    updatedArtefact = patchRes.data as { thumbnail?: unknown }
+    debug(`${dir}: PATCHed metadata into ${artefactId}`)
+  } catch (err: any) {
+    const status = err?.response?.status
+    if (status === 404) {
+      debug(`${dir}: artefact ${artefactId} not in registry — publish must have failed, skipping metadata push`)
+      return
+    }
+    throw err
+  }
+
+  // Render the legacy v5 icon as an SVG and upload it as the artefact
+  // thumbnail. Skipped if the artefact already has a thumbnail — re-runs of
+  // this migration must not clobber a manually uploaded one. Upload failures
+  // are swallowed with a debug log so a single bad icon doesn't fail the run.
+  if (metadata.icon !== undefined && metadata.icon !== null) {
+    if (updatedArtefact?.thumbnail) {
+      debug(`${dir}: artefact ${artefactId} already has a thumbnail, skipping`)
+    } else {
+      const svg = extractIconSvg(metadata.icon)
+      if (!svg) {
+        debug(`${dir}: unrecognized icon shape, skipping thumbnail`)
+      } else {
+        try {
+          const tform = new FormData()
+          tform.append('file', new Blob([svg], { type: 'image/svg+xml' }), 'icon.svg')
+          await ax.post(`/api/v1/artefacts/${encodeURIComponent(artefactId)}/thumbnail`, tform, {
+            validateStatus: s => s === 201
+          })
+          debug(`${dir}: uploaded thumbnail`)
+        } catch (err: any) {
+          const status = err?.response?.status
+          const body = err?.response?.data
+          const bodyStr = typeof body === 'string' ? body : JSON.stringify(body)
+          debug(`${dir}: thumbnail upload failed (${status ?? 'no-response'}: ${bodyStr ?? err?.message}) — leaving artefact without icon`)
+        }
+      }
+    }
+  }
+
+  // Note: we do NOT auto-create access-grants for privateAccess entries.
+  // privateAccess governs whether an account *may* see the artefact; the
+  // access-grant is a separate operator enrolment step that the superadmin
+  // owns from the registry UI. Pre-creating grants here would silently
+  // expand the trust surface beyond what the v5 access.json expressed.
+}
+
+export default {
+  description: 'v6.0 — publish legacy plugins (and their metadata/access) from the volume into registry',
+  async exec (_db, debug) {
+    if (!config.dataDir) {
+      debug('legacy plugins volume not mounted (dataDir unset), skipping')
+      return
+    }
+    const pluginsDir = path.join(config.dataDir, 'plugins')
+    if (!existsSync(pluginsDir)) {
+      debug('legacy plugins volume not mounted, skipping')
+      return
+    }
+
+    const dirs = await listLegacyPluginDirs(pluginsDir, debug)
+    const ax = createRegistryClient()
+
+    // Track per-dir failures so the operator sees them surfaced together at the
+    // end. A single broken plugin dir (stale symlink, corrupted node_modules,
+    // partial install) shouldn't block migration of the rest.
+    const failures: { dir: string, error: string }[] = []
+    for (const dir of dirs) {
+      try {
+        const manifest = await readPluginManifest(pluginsDir, dir, debug)
+        if (!manifest) continue
+        await publishToRegistry(ax, pluginsDir, dir, manifest, debug)
+        await pushMetadataAndAccess(ax, pluginsDir, dir, debug)
+      } catch (err: any) {
+        const msg = err?.code ? `${err.code}: ${err.message}` : (err?.message ?? String(err))
+        debug(`${dir}: failed to migrate (${msg}) — leaving on volume for manual reconciliation`)
+        failures.push({ dir, error: msg })
+      }
+    }
+    if (failures.length > 0) {
+      debug(`${failures.length} plugin dir(s) failed migration: ${failures.map(f => f.dir).join(', ')}. Inspect logs above and reconcile manually before the v7.0 upgrade.`)
+    }
+  }
+} as UpgradeScript
diff --git a/worker/config/custom-environment-variables.mjs b/worker/config/custom-environment-variables.mjs
index 563424c1..cf7b8e20 100644
--- a/worker/config/custom-environment-variables.mjs
+++ b/worker/config/custom-environment-variables.mjs
@@ -18,10 +18,12 @@ export default {
   maxFailures: 'MAX_FAILURES',
   maxFailuresCooldown: 'MAX_FAILURES_COOLDOWN',
   mongoUrl: 'MONGO_URL',
+  privateEventsUrl: 'PRIVATE_EVENTS_URL',
+  privateRegistryUrl: 'PRIVATE_REGISTRY_URL',
   secretKeys: {
-    events: 'SECRET_EVENTS'
+    events: 'SECRET_EVENTS',
+    registry: 'SECRET_REGISTRY'
   },
-  privateEventsUrl: 'PRIVATE_EVENTS_URL',
   locks: {
     ttl: 'LOCKS_TTL'
   },
diff --git a/worker/config/default.mjs b/worker/config/default.mjs
index 9168cf9b..b4630c4f 100644
--- a/worker/config/default.mjs
+++ b/worker/config/default.mjs
@@ -1,7 +1,10 @@
 export default {
   cipherPassword: undefined,
-  dataDir: '/app/data',
-  tmpDir: null, // will be dataDir + '/tmp' if null
+  // Optional. When set, the legacy plugins volume at <dataDir>/plugins is read
+  // by the v6.0 boot migration. Drops with v7.0.
+  dataDir: null,
+  // Defaults to <dataDir>/tmp when dataDir is set, else <os.tmpdir>/data-fair-processings.
+  tmpDir: null,
   dataFairAdminMode: false,
   dataFairAPIKey: null,
   dataFairUrl: 'http://localhost:5600/data-fair',
@@ -25,8 +28,13 @@ export default {
   maxFailuresCooldown: 12, // in hours
   mongoUrl: 'mongodb://localhost:27017/data-fair-processings',
   privateEventsUrl: null,
+  // Internal URL the worker uses for server-to-server calls to registry.
+  privateRegistryUrl: 'http://registry:8080',
   secretKeys: {
-    events: null
+    events: null,
+    // x-secret-key shared with registry. Required for prepare-hook downloads
+    // and the v6.0 first-boot migration.
+    registry: undefined
   },
   locks: {
     // in seconds
diff --git a/worker/config/development.mjs b/worker/config/development.mjs
index 7015cb5f..7de3189d 100644
--- a/worker/config/development.mjs
+++ b/worker/config/development.mjs
@@ -1,18 +1,24 @@
 const mongoPort = process.env.MONGO_PORT ?? '27017'
 const eventsPort = process.env.EVENTS_PORT ?? '8083'
 const dfPort = process.env.DF_PORT ?? '8081'
+const registryPort = process.env.REGISTRY_PORT ?? '8085'
 const observerPort = parseInt(process.env.DEV_WORKER_OBSERVER_PORT ?? '9091')
 
 export default {
   cipherPassword: 'dev',
   dataDir: '../data/development',
   dataFairAdminMode: true,
-  dataFairAPIKey: '', // override in local-development.cjs
+  // Dev/test default. The matching settings doc in DF's mongo is seeded by
+  // tests/state-setup.ts (idempotent). Real deployments override this via
+  // DATA_FAIR_API_KEY or local-development.cjs.
+  dataFairAPIKey: 'dev-test-processings-worker-key',
   maxFailures: 2,
   maxFailuresCooldown: 0.05, // 3 minutes
   mongoUrl: `mongodb://localhost:${mongoPort}/data-fair-processings-development`,
+  privateRegistryUrl: `http://localhost:${registryPort}/registry`,
   secretKeys: {
-    events: 'secret-events'
+    events: 'secret-events',
+    registry: 'secret-registry-internal'
   },
   observer: {
     port: observerPort
diff --git a/worker/config/type/schema.json b/worker/config/type/schema.json
index a5f559e9..9c7b724f 100644
--- a/worker/config/type/schema.json
+++ b/worker/config/type/schema.json
@@ -12,7 +12,6 @@
   "additionalProperties": false,
   "required": [
     "cipherPassword",
-    "dataDir",
     "dataFairAPIKey",
     "dataFairAdminMode",
     "dataFairUrl",
@@ -23,6 +22,7 @@
     "mongoUrl",
     "locks",
     "observer",
+    "privateRegistryUrl",
     "runsRetention",
     "worker",
     "secretKeys",
@@ -33,7 +33,8 @@
       "type": "string"
     },
     "dataDir": {
-      "type": "string"
+      "type": ["string", "null"],
+      "description": "Optional. When set, the legacy plugins volume at <dataDir>/plugins is read by the v6.0 boot migration. Drops with v7.0."
     },
     "tmpDir": {
       "type": "string"
@@ -78,11 +79,21 @@
     "mongoUrl": {
       "type": "string"
     },
+    "privateRegistryUrl": {
+      "type": "string",
+      "pattern": "^https?://",
+      "description": "Internal URL used by the worker to call registry server-to-server."
+    },
     "secretKeys": {
       "type": "object",
+      "required": ["registry"],
       "properties": {
         "events": {
           "type": ["string", "null"]
+        },
+        "registry": {
+          "type": "string",
+          "description": "x-secret-key shared with registry. Required for prepare-hook downloads and the v6.0 first-boot migration."
         }
       }
     },
@@ -156,4 +167,4 @@
     "get": {},
     "has": {}
   }
-}
\ No newline at end of file
+}
diff --git a/worker/package.json b/worker/package.json
index 7e8836f3..115defb1 100644
--- a/worker/package.json
+++ b/worker/package.json
@@ -14,11 +14,15 @@
   "devDependencies": {
     "@data-fair/lib-express": "^1.22.5",
     "@types/nodemailer": "^6.4.16",
-    "@types/resolve-path": "^1.4.3"
+    "@types/resolve-path": "^1.4.3",
+    "@types/tar": "^6.1.13",
+    "@types/tar-stream": "^3.1.4"
   },
   "dependencies": {
     "@data-fair/lib-node": "^2.12.1",
+    "@data-fair/lib-node-registry": "^0.4.0",
     "@data-fair/processings-shared": "*",
+    "@mdi/js": "^7.4.47",
     "axios": "^1.8.3",
     "axios-retry": "^4.5.0",
     "config": "^4.4.1",
@@ -27,6 +31,9 @@
     "nodemailer": "^8.0.4",
     "prom-client": "^15.1.3",
     "resolve-path": "^1.4.0",
+    "semver": "^7.7.4",
+    "tar": "^7.5.1",
+    "tar-stream": "^3.1.0",
     "tmp-promise": "^3.0.3",
     "tree-kill": "^1.2.2"
   }
diff --git a/worker/src/config.ts b/worker/src/config.ts
index 77570431..6006be61 100644
--- a/worker/src/config.ts
+++ b/worker/src/config.ts
@@ -1,7 +1,22 @@
+import path from 'node:path'
+import os from 'node:os'
 import type { WorkerConfig } from '../config/type/index.ts'
 import { assertValid } from '../config/type/index.ts'
 import config from 'config'
 
 assertValid(config, { lang: 'en', name: 'config', internal: true })
 
-export default config as unknown as WorkerConfig
+const rawConfig = config as unknown as WorkerConfig
+
+if (!rawConfig.tmpDir) {
+  rawConfig.tmpDir = rawConfig.dataDir
+    ? path.join(rawConfig.dataDir, 'tmp')
+    : path.join(os.tmpdir(), 'data-fair-processings')
+}
+
+const workerConfig = rawConfig as WorkerConfig & { tmpDir: string }
+
+// cacheDir is always a subdirectory of tmpDir.
+export const registryCacheDir = path.join(workerConfig.tmpDir, 'registry-cache')
+
+export default workerConfig
diff --git a/worker/src/task/task.ts b/worker/src/task/task.ts
index 6c5cd2e9..41ba3d46 100644
--- a/worker/src/task/task.ts
+++ b/worker/src/task/task.ts
@@ -9,21 +9,22 @@ import resolvePath from 'resolve-path'
 import tmp from 'tmp-promise'
 import { DataFairWsClient } from '@data-fair/lib-node/ws-client.js'
 import * as wsEmitter from '@data-fair/lib-node/ws-emitter.js'
+import { ensureArtefact } from '@data-fair/lib-node-registry'
 import { decipher } from '@data-fair/processings-shared/cipher.ts'
+import { importPluginModule } from '@data-fair/processings-shared/plugin-load.ts'
 import { running } from '../utils/runs.ts'
-import config from '#config'
+import config, { registryCacheDir } from '#config'
 import mongo from '#mongo'
 import { getAxiosInstance, getHttpErrorMessage, prepareAxiosError } from './axios.ts'
 
-fs.ensureDirSync(config.dataDir)
-const baseTmpDir = config.tmpDir || path.join(config.dataDir, 'tmp')
-fs.ensureDirSync(baseTmpDir)
+if (config.dataDir) fs.ensureDirSync(config.dataDir)
+fs.ensureDirSync(config.tmpDir)
 
 tmp.setGracefulCleanup()
 
 let pluginModule: { run: (context: ProcessingContext) => Promise<{ deleteOnComplete?: boolean } | void>, stop?: () => Promise<void> }
 let _stopped: boolean
-const processingsDir = path.join(config.dataDir, 'processings')
+const processingsDir = path.join(config.dataDir ?? config.tmpDir, 'processings')
 
 /**
  * Create a WebSocket instance.
@@ -85,18 +86,49 @@ export const run = async (mailTransport: any) => {
   }
   await running(run)
   console.log('<running>')
-  const pluginDir = path.resolve(config.dataDir, 'plugins', processing.plugin)
-  let pluginConfig = {}
-  if (await fs.pathExists(pluginDir + '-config.json')) {
-    pluginConfig = await fs.readJson(pluginDir + '-config.json')
+  // Resolve plugin via registry. lib-node downloads + extracts the tarball into
+  // registryCacheDir on cache miss, returns the existing path on cache hit.
+  // account is passed so registry enforces this owner's grants. `processing.plugin`
+  // is the registry artefact id, passed through as-is; the cache is invalidated
+  // when the artefact's dataUpdatedAt bumps.
+  const account = {
+    type: processing.owner.type,
+    id: processing.owner.id,
+    ...(processing.owner.department ? { department: processing.owner.department } : {})
   }
-  if (!await fs.pathExists(pluginDir + '/index.js')) {
-    throw new Error('fichier source manquant : ' + pluginDir + '/index.js')
+  let ensured
+  try {
+    ensured = await ensureArtefact({
+      registryUrl: config.privateRegistryUrl,
+      secretKey: config.secretKeys.registry,
+      artefactId: processing.plugin,
+      cacheDir: registryCacheDir,
+      architecture: process.arch,
+      account
+    })
+  } catch (err) {
+    const status = (err as any)?.status ?? (err as any)?.statusCode
+    if (status === 404 || status === 403) {
+      await log.error(`Le plugin ${processing.plugin} n'est plus disponible (supprimé ou accès retiré).`)
+    }
+    throw err
+  }
+  const pluginDir = ensured.path
+
+  // Legacy plugin-config (deprecated, removed in v7.0): if dataDir is set the
+  // legacy plugins volume is implicitly enabled — read the per-instance global
+  // config keyed by the plugin id (the legacy directory name).
+  let pluginConfig: Record<string, unknown> = {}
+  if (config.dataDir) {
+    const legacyConfigPath = path.join(config.dataDir, 'plugins', `${processing.plugin}-config.json`)
+    if (await fs.pathExists(legacyConfigPath)) {
+      pluginConfig = await fs.readJson(legacyConfigPath)
+      await log.warning(`deprecation: plugin ${processing.plugin} still relies on legacy plugin-config from volume`)
+    }
   }
-
   const dir = resolvePath(processingsDir, processing._id)
   await fs.ensureDir(dir)
-  const tmpDir = await tmp.dir({ unsafeCleanup: true, tmpdir: baseTmpDir, prefix: `processing-run-${processing._id}-${run._id}` })
+  const tmpDir = await tmp.dir({ unsafeCleanup: true, tmpdir: config.tmpDir, prefix: `processing-run-${processing._id}-${run._id}` })
   const processingConfig = processing.config || {}
 
   const axiosInstance = getAxiosInstance(processing, log)
@@ -131,7 +163,7 @@ export const run = async (mailTransport: any) => {
 
   const cwd = process.cwd()
   try {
-    pluginModule = await import(path.join(pluginDir + '/index.js'))
+    pluginModule = await importPluginModule(pluginDir)
     process.chdir(dir)
     const result = await pluginModule.run(context)
     if (result?.deleteOnComplete) {
diff --git a/worker/src/worker.ts b/worker/src/worker.ts
index 3fa67a22..e107892d 100644
--- a/worker/src/worker.ts
+++ b/worker/src/worker.ts
@@ -33,7 +33,7 @@ let killLoopPromise: Promise<void>
 
 // Start the worker (start the mail loop and all dependencies)
 export const start = async () => {
-  if (!existsSync(config.dataDir) && process.env.NODE_ENV === 'production') {
+  if (config.dataDir && !existsSync(config.dataDir) && process.env.NODE_ENV === 'production') {
     throw new Error(`Data directory ${resolvePath(config.dataDir)} was not mounted`)
   }
   await mongo.init()