diff --git a/app_new/core/routes/setup_wizard.py b/app_new/core/routes/setup_wizard.py
index 0724cde..9ab4bbb 100644
--- a/app_new/core/routes/setup_wizard.py
+++ b/app_new/core/routes/setup_wizard.py
@@ -14,7 +14,7 @@ from ..models.user import User
 from ..models.college import College, Building, Zone, Room
 from ..models.equipment import EquipmentCategory
 from ..models.maintenance import Lot
-from ..models.rbac import Role
+from ..models.rbac import Role, Permission, RolePermission, UserRole
 from ..services.rbac import replace_user_roles
 from ..authorization import has_permission
 from ..models.planning import WorkSchedule, CollegeClosure, ClosureWorkDay
@@ -264,16 +264,33 @@ def api_save_step(step):
                 user = User(
                     username=username,
                     email=f'{username}@gmao.local',
-                    role='admin',
+                    role='admin',  # LEGACY uniquement ; la sécurité utilise UserRole.
                     is_active=True
                 )
                 user.set_password(password)
             db.session.add(user)
             db.session.flush()
 
-            admin_role = Role.query.filter_by(slug='admin', is_active=True).first()
-            if admin_role:
-                replace_user_roles(user, [admin_role.id])
+            # Le premier compte est le compte de récupération de l'installation
+            # et doit recevoir explicitement le rôle protégé super_admin.
+            super_role = Role.query.filter_by(slug='super_admin', is_active=True).first()
+            if not super_role:
+                super_role = Role(slug='super_admin', name='Super administrateur',
+                                  description="Rôle système protégé donnant un accès complet à l'application.",
+                                  is_system=True, is_active=True)
+                db.session.add(super_role)
+                db.session.flush()
+            wildcard = Permission.query.filter_by(code='*').first()
+            if not wildcard:
+                wildcard = Permission(code='*', name="Accès complet à l'application",
+                                      module='system', action='all',
+                                      description="Accès complet réservé au super administrateur.",
+                                      is_active=True)
+                db.session.add(wildcard)
+                db.session.flush()
+            if not RolePermission.query.filter_by(role_id=super_role.id, permission_id=wildcard.id).first():
+                db.session.add(RolePermission(role_id=super_role.id, permission_id=wildcard.id, effect='allow'))
+            replace_user_roles(user, [super_role.id])
             
             progress.admin_username = username
             progress.step = 2
@@ -588,7 +605,9 @@ def api_complete():
     
     try:
         progress = SetupProgress.get()
-        admin = User.query.filter_by(role='admin', is_active=True).first()
+        super_role = Role.query.filter_by(slug='super_admin', is_active=True).first()
+        admin = next((link.user for link in (super_role.user_links if super_role else [])
+                      if link.user and link.user.is_active), None)
         if not admin:
             return jsonify({'error': 'Un administrateur actif est requis'}), 400
         if progress.step < 10: