diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 386f982..519f8d5 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -25,6 +25,11 @@ env:
   GITEA_HOST: gitea.fse-media.group
   DEPLOY_PATH: /data/opt/byw-voicehub
   IMAGE_NAME: byw-voicehub
+  GH_PROXY_PREFIX: https://v4.gh-proxy.org/
+  APT_MIRROR_DEBIAN: https://mirrors.tuna.tsinghua.edu.cn/debian
+  APT_MIRROR_DEBIAN_SECURITY: https://mirrors.tuna.tsinghua.edu.cn/debian-security
+  HTTP_PROXY_EXAMPLE: ""
+  HTTPS_PROXY_EXAMPLE: ""
 
 jobs:
   preflight:
@@ -34,13 +39,31 @@ jobs:
     container:
       image: node:22-bookworm-slim
     steps:
-      - name: 安装基础运行依赖（git/ca-certificates）
+      - name: 安装基础运行依赖（git/ca-certificates，已换清华 TUNA 源）
         run: |
           set -euxo pipefail
+          # Debian 12 (bookworm) 换清华 TUNA 国内镜像（避免 deb.debian.org 国外源速度 <200KB/s）
+          SOURCES_FILE="/etc/apt/sources.list.d/debian.sources"
+          if [ -f "${SOURCES_FILE}" ]; then
+            sed -i "s|http://deb.debian.org/debian|${APT_MIRROR_DEBIAN}|g" "${SOURCES_FILE}"
+            sed -i "s|http://deb.debian.org/debian-security|${APT_MIRROR_DEBIAN_SECURITY}|g" "${SOURCES_FILE}"
+            sed -i "s|https://deb.debian.org/debian|${APT_MIRROR_DEBIAN}|g" "${SOURCES_FILE}"
+            sed -i "s|https://deb.debian.org/debian-security|${APT_MIRROR_DEBIAN_SECURITY}|g" "${SOURCES_FILE}"
+          else
+            # 兜底旧格式 /etc/apt/sources.list
+            if [ -f /etc/apt/sources.list ]; then
+              sed -i "s|http://deb.debian.org/debian|${APT_MIRROR_DEBIAN}|g" /etc/apt/sources.list
+              sed -i "s|https://deb.debian.org/debian|${APT_MIRROR_DEBIAN}|g" /etc/apt/sources.list
+              sed -i "s|http://security.debian.org/debian-security|${APT_MIRROR_DEBIAN_SECURITY}|g" /etc/apt/sources.list
+              sed -i "s|https://security.debian.org/debian-security|${APT_MIRROR_DEBIAN_SECURITY}|g" /etc/apt/sources.list
+            fi
+          fi
           apt-get update -qq
           DEBIAN_FRONTEND=noninteractive apt-get install -yqq --no-install-recommends \
             git ca-certificates curl
           rm -rf /var/lib/apt/lists/*
+          # 全局 git 代理：任何 git clone/fetch/pull https://github.com/... 自动走 gh-proxy.com 前缀
+          git config --system url."${GH_PROXY_PREFIX}https://github.com/".insteadOf "https://github.com/" || true
           git --version
           node -v
           npm -v
@@ -90,6 +113,34 @@ jobs:
       image_full: ${{ steps.meta.outputs.full }}
       image_latest: ${{ steps.meta.outputs.latest }}
     steps:
+      - name: 系统环境准备（Ubuntu 22.04 默认镜像源换清华 + 全局 GitHub gh-proxy）
+        run: |
+          set -euxo pipefail
+          # Ubuntu 22.04 默认是 http://archive.ubuntu.com/ubuntu 和 http://security.ubuntu.com/ubuntu
+          if command -v apt-get >/dev/null 2>&1 && [ -f /etc/apt/sources.list ]; then
+            sudo sed -i \
+              -e 's|http://archive.ubuntu.com/ubuntu|https://mirrors.tuna.tsinghua.edu.cn/ubuntu|g' \
+              -e 's|http://security.ubuntu.com/ubuntu|https://mirrors.tuna.tsinghua.edu.cn/ubuntu-security|g' \
+              -e 's|https://archive.ubuntu.com/ubuntu|https://mirrors.tuna.tsinghua.edu.cn/ubuntu|g' \
+              /etc/apt/sources.list
+          fi
+          if command -v apt-get >/dev/null 2>&1 && ls /etc/apt/sources.list.d/*.sources 1>/dev/null 2>&1; then
+            for f in /etc/apt/sources.list.d/*.sources; do
+              sudo sed -i \
+                -e 's|http://archive.ubuntu.com/ubuntu|https://mirrors.tuna.tsinghua.edu.cn/ubuntu|g' \
+                -e 's|http://security.ubuntu.com/ubuntu|https://mirrors.tuna.tsinghua.edu.cn/ubuntu-security|g' \
+                "${f}" 2>/dev/null || true
+            done
+          fi
+          # 全局 git：所有 https://github.com/ 自动走 gh-proxy 前缀
+          sudo git config --system url."${GH_PROXY_PREFIX}https://github.com/".insteadOf "https://github.com/" || true
+          # npm：强制用 npmmirror（与 preflight 对齐）
+          npm config set registry https://registry.npmmirror.com >/dev/null 2>&1 || true
+          echo "环境准备完成"
+          cat /etc/os-release 2>/dev/null | head -4 || true
+          docker --version
+          docker buildx version || echo "buildx 未安装"
+
       - name: 检出代码
         run: |
           set -euxo pipefail
@@ -120,17 +171,34 @@ jobs:
           echo "Latest image : ${IMG_LATEST}"
           echo "======================================"
 
-      - name: 初始化 Docker Buildx builder
+      - name: 初始化 Docker Buildx builder（带国内 registry-mirrors + gh-proxy 环境）
         run: |
           set -euxo pipefail
           BUILDER_NAME="multi"
-          # 如果已存在同名 builder，直接用；否则创建（默认 driver docker-container，支持 --cache-to registry）
-          if ! docker buildx inspect "${BUILDER_NAME}" >/dev/null 2>&1; then
-            docker buildx create --name "${BUILDER_NAME}" --driver docker-container --use \
-              --buildkitd-flags '--allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host'
-          else
-            docker buildx use "${BUILDER_NAME}"
-          fi
+          BKK_CFG="$(mktemp -t buildkitd_XXXXXX.toml)"
+          # 用 printf 逐行写 buildkitd 配置，避免 YAML parser 把 heredoc 内部的 [...] 误判为 YAML key
+          {
+            printf '[worker.oci]\n  max-parallelism = 2\n\n'
+            printf '[registry."docker.io"]\n  mirrors = ["docker.m.daocloud.io","dockerproxy.com","hub-mirror.c.163.com","docker.nju.edu.cn","docker.mirrors.ustc.edu.cn"]\n\n'
+            printf '[registry."ghcr.io"]\n  mirrors = ["ghcr.nju.edu.cn","ghcr.dockerproxy.com"]\n\n'
+            printf '[registry."k8s.gcr.io"]\n  mirrors = ["k8s-gcr.m.daocloud.io","registry.cn-hangzhou.aliyuncs.com/google_containers"]\n'
+          } > "${BKK_CFG}"
+          docker buildx rm "${BUILDER_NAME}" 2>/dev/null || true
+          docker buildx create \
+            --name "${BUILDER_NAME}" \
+            --driver docker-container \
+            --use \
+            --config "${BKK_CFG}" \
+            --buildkitd-flags '--allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host' \
+            --driver-opt network=host \
+            --driver-opt "env=HTTP_PROXY=${HTTP_PROXY_EXAMPLE}" \
+            --driver-opt "env=HTTPS_PROXY=${HTTPS_PROXY_EXAMPLE}"
+          rm -f "${BKK_CFG}"
+          export GIT_CONFIG_COUNT=2
+          export GIT_CONFIG_KEY_0="url.${GH_PROXY_PREFIX}https://github.com/.insteadOf"
+          export GIT_CONFIG_VALUE_0="https://github.com/"
+          export GIT_CONFIG_KEY_1="url.${GH_PROXY_PREFIX}https://gist.github.com/.insteadOf"
+          export GIT_CONFIG_VALUE_1="https://gist.github.com/"
           docker buildx inspect --bootstrap
 
       - name: 登录 Gitea 容器仓库
@@ -273,6 +341,7 @@ jobs:
             IMAGE_LATEST="${IMAGE_LATEST}" \
             DEPLOY_PATH="${DEPLOY_PATH}" \
             GITEA_HOST="${GITEA_HOST}" \
+            GH_PROXY_PREFIX="${GH_PROXY_PREFIX}" \
             REGISTRY_PULL_USER="${REGISTRY_PULL_USER}" \
             REGISTRY_PULL_TOKEN="${REGISTRY_PULL_TOKEN}" \
             IMAGE_NAME="${IMAGE_NAME}" \
@@ -316,8 +385,11 @@ jobs:
               echo "docker-compose.override.yml written, image=${IMAGE_NEW}"
 
               if [ ! -f docker-compose.yml ]; then
-                echo "docker-compose.yml 不存在，自动从仓库模板下载"
+                echo "docker-compose.yml 不存在，自动从仓库模板下载（如访问 GitHub 会自动加 gh-proxy 前缀）"
                 TEMPLATE_URL="${GITHUB_SERVER_URL:-https://${GITEA_HOST}}/${GITHUB_REPOSITORY}/raw/branch/${GITHUB_REF_NAME:-main}/docker-compose.yml"
+                case "${TEMPLATE_URL}" in
+                  *"://github.com/"*) TEMPLATE_URL="${GH_PROXY_PREFIX}${TEMPLATE_URL}" ;;
+                esac
                 echo "URL=${TEMPLATE_URL}"
                 curl -fsSL --max-time 30 "${TEMPLATE_URL}" -o docker-compose.yml \
                   || echo "自动下载模板失败，请手动上传 docker-compose.yml 和 .env（参考仓库根目录 .env.example）"