diff --git a/package.json b/package.json
index 037b5b3..6e4e4f3 100644
--- a/package.json
+++ b/package.json
@@ -72,6 +72,9 @@
     "./features/admin": {
       "import": "./dist/features/admin/index.js"
     },
+    "./features/admin/protect": {
+      "import": "./dist/features/admin/protect.js"
+    },
     "./features/admin/server": {
       "import": "./dist/features/admin/AdminPage.server.js"
     },
diff --git a/src/core/api/router.js b/src/core/api/router.js
index a84c5d2..041e832 100644
--- a/src/core/api/router.js
+++ b/src/core/api/router.js
@@ -18,7 +18,6 @@
  *       → handler(request, params, context)
  */
 
-import { cookies } from 'next/headers';
 import { getSessionCookieName } from '@zen/core/shared/config';
 import { checkRateLimit, getIpFromRequest, formatRetryAfter } from '@zen/core/shared/rate-limit';
 import { fail } from '@zen/core/shared/logger';
@@ -40,6 +39,7 @@ const COOKIE_NAME = getSessionCookieName();
  * @returns {Promise<Object>} session
  */
 export async function requireAuth() {
+  const { cookies } = await import('next/headers');
   const cookieStore = await cookies();
   const sessionToken = cookieStore.get(COOKIE_NAME)?.value;
 
diff --git a/src/features/admin/README.md b/src/features/admin/README.md
index 6b17066..98c2020 100644
--- a/src/features/admin/README.md
+++ b/src/features/admin/README.md
@@ -10,7 +10,7 @@ Ce répertoire fournit l'interface d'administration complète : layout, navigati
 
 ```
 src/features/admin/
-├── index.js                    protectAdmin, isAdmin, buildNavigationSections, registre
+├── index.js                    buildNavigationSections, registre (Next.js-free)
 ├── protect.js                  gardes d'accès
 ├── navigation.js               buildNavigationSections, buildBottomNavItems
 ├── registry.js                 registre runtime d'extensions
@@ -50,7 +50,11 @@ src/features/admin/
 ## Import
 
 ```js
-import { protectAdmin, isAdmin, buildNavigationSections } from '@zen/core/features/admin';
+// Gardes RSC — chemin dédié (next/navigation + next/headers, non compatible turbopackIgnore)
+import { protectAdmin, isAdmin } from '@zen/core/features/admin/protect';
+
+// Registre et navigation — compatible modules externes
+import { buildNavigationSections } from '@zen/core/features/admin';
 import {
   registerWidget,
   registerWidgetFetcher,
diff --git a/src/features/admin/index.js b/src/features/admin/index.js
index 64206e3..c877073 100644
--- a/src/features/admin/index.js
+++ b/src/features/admin/index.js
@@ -1,16 +1,20 @@
 /**
- * Zen Admin — barrel serveur.
+ * Zen Admin — barrel serveur (Next.js-free).
  *
- * - Gardes d'accès : protectAdmin, isAdmin.
  * - Navigation : buildNavigationSections.
  * - Registre d'extensions : registerWidget, registerWidgetFetcher, registerNavItem,
  *   registerNavSection, registerPage (import une seule fois depuis le layout
  *   racine de l'app consommatrice pour que les side effects s'exécutent).
  *
+ * Ne re-exporte PAS protect.js — ce fichier importe `next/navigation` et
+ * `@zen/core/features/auth/actions` (qui importe `next/headers`) au niveau
+ * top-level. Ce barrel est importé par des modules externes pendant leur
+ * register(), avant que Next.js ait activé ses alias de modules.
+ * Importer les gardes explicitement via @zen/core/features/admin/protect.
+ *
  * Client components sous @zen/core/features/admin/components.
  */
 
-export { protectAdmin, isAdmin } from './protect.js';
 export { buildNavigationSections } from './navigation.js';
 export {
   registerWidget,
diff --git a/src/features/auth/index.js b/src/features/auth/index.js
index c1ab34c..bae98c5 100644
--- a/src/features/auth/index.js
+++ b/src/features/auth/index.js
@@ -1,10 +1,11 @@
 /**
  * Zen Authentication — server barrel (Next.js-free).
  *
- * Does NOT re-export actions.js — that file imports `next/headers` at the
- * top level and cannot be pulled in via this barrel (which is imported by
- * external modules during instrumentation, before Next.js aliases are active).
- * Import server actions explicitly via @zen/core/features/auth/actions.
+ * Ne re-exporte PAS actions.js — ce fichier importe `next/headers` au niveau
+ * top-level et ne peut pas être tiré via ce barrel (qui peut être importé par
+ * des modules externes pendant leur register(), avant que Next.js ait activé
+ * ses alias de modules). Importer les server actions via
+ * @zen/core/features/auth/actions.
  */
 
 export {