diff --git a/files/vm-provision.sh b/files/vm-provision.sh
index c920ce6..e0d5448 100755
--- a/files/vm-provision.sh
+++ b/files/vm-provision.sh
@@ -191,17 +191,6 @@ EOF
     cp -ar /etc/letsencrypt /root/snster-kaz/kaz/prod/
     cp -ar /etc/letsencrypt /root/snster-kaz/isp-a/home/
 
-    # Build SNSTER KAZ !
-    snster -c /root/snster-kaz create
-    cp "${VAGRANT_SRC_DIR}/vm-install-kaz.sh" /root/
-    chmod +x /root/vm-install-kaz.sh
-    if [ "${NOKAZ}" == "true" ]; then
-      echo "on ne fait pas l'install de kaz sur kaz-prod"
-    else
-      echo "on installe kaz sur kaz-prod"
-      bash "/root/vm-install-kaz.sh"
-    fi
-
     # On monte le filesystem de kaz-prod dans le /kaz de la VM pour le dév (en nofail)
     mkdir /kaz-prod /kaz
     echo "overlay	/kaz-prod	overlay	lowerdir=/var/lib/lxc/sr-masters-bullseye/rootfs,upperdir=/var/lib/lxc/kaz-kaz-prod/overlay/delta,workdir=/var/lib/lxc/kaz-kaz-prod/overlay/work,nofail  0 0" >> /etc/fstab
@@ -210,6 +199,19 @@ EOF
     # On met le KAZGUARD pour la mise au point
     echo "export KAZGUARD='true'" >> /root/.bashrc
 
+    # Build SNSTER KAZ !
+    snster -c /root/snster-kaz create
+    cp "${VAGRANT_SRC_DIR}/vm-install-kaz.sh" /root/
+    chmod +x /root/vm-install-kaz.sh
+    cp "${VAGRANT_SRC_DIR}/vm-upgrade.sh" /root/
+    chmod +x /root/vm-upgrade.sh
+    if [ "${NOKAZ}" == "true" ]; then
+      echo "on ne fait pas l'install de kaz sur kaz-prod"
+    else
+      echo "on installe kaz sur kaz-prod"
+      bash "/root/vm-install-kaz.sh"
+    fi
+
     echo "########## ********** End Vagrant $(date +%D-%T)"
 )  > >(tee ${DebugLog}stdout.log) 2> >(tee ${DebugLog}stderr.log >&2)
 
diff --git a/files/vm-upgrade.sh b/files/vm-upgrade.sh
new file mode 100755
index 0000000..b42e670
--- /dev/null
+++ b/files/vm-upgrade.sh
@@ -0,0 +1,42 @@
+#!/bin/bash
+# Upgrade de tout sauf kaz-prod
+
+if [ -z "${KAZGUARD}" ] ; then
+    exit 1
+fi
+set -e
+
+# On met à jour SNSTER
+cd /root/snster
+git switch main
+git pull
+./install.sh
+
+# On récupère le dernier kaz-vagrant
+cd /tmp
+git clone https://git.kaz.bzh/KAZ/kaz-vagrant.git || (cd kaz-vagrant && git pull)
+cd /tmp/kaz-vagrant
+git switch develop-snster
+
+# On écrase les anciens fichiers
+cp -ar /tmp/kaz-vagrant/files/snster-kaz /root/
+
+# On détruit et reconstruit tout sauf kaz-prod
+SNSTER="snster -c /root/snster-kaz"
+$SNSTER destroy isp-a-home
+$SNSTER destroy isp-a-infra
+$SNSTER destroy isp-a-router
+$SNSTER destroy kaz-router
+$SNSTER destroy mica-router
+$SNSTER destroy mica-infra
+$SNSTER destroy opendns-router
+$SNSTER destroy opendns-resolver
+$SNSTER destroy root-p-router
+$SNSTER destroy root-p-rootns
+$SNSTER destroy tld-sns-router
+$SNSTER destroy tld-sns-ns
+$SNSTER destroy transit-a-router
+
+$SNSTER create
+
+$SNSTER start