diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 519f8d5..91ba3e0 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -28,6 +28,12 @@ env:
   GH_PROXY_PREFIX: https://v4.gh-proxy.org/
   APT_MIRROR_DEBIAN: https://mirrors.tuna.tsinghua.edu.cn/debian
   APT_MIRROR_DEBIAN_SECURITY: https://mirrors.tuna.tsinghua.edu.cn/debian-security
+  APT_MIRROR_DEBIAN_HTTP: http://mirrors.tuna.tsinghua.edu.cn/debian
+  APT_MIRROR_DEBIAN_SECURITY_HTTP: http://mirrors.tuna.tsinghua.edu.cn/debian-security
+  APT_MIRROR_UBUNTU: https://mirrors.tuna.tsinghua.edu.cn/ubuntu
+  APT_MIRROR_UBUNTU_SECURITY: https://mirrors.tuna.tsinghua.edu.cn/ubuntu-security
+  APT_MIRROR_UBUNTU_HTTP: http://mirrors.tuna.tsinghua.edu.cn/ubuntu
+  APT_MIRROR_UBUNTU_SECURITY_HTTP: http://mirrors.tuna.tsinghua.edu.cn/ubuntu-security
   HTTP_PROXY_EXAMPLE: ""
   HTTPS_PROXY_EXAMPLE: ""
 
@@ -42,27 +48,39 @@ jobs:
       - name: 安装基础运行依赖（git/ca-certificates，已换清华 TUNA 源）
         run: |
           set -euxo pipefail
-          # Debian 12 (bookworm) 换清华 TUNA 国内镜像（避免 deb.debian.org 国外源速度 <200KB/s）
+          # ========== Step 0：先用 HTTP 清华源装 ca-certificates（解鸡生蛋：HTTPS 需要证书，证书得先用 HTTP 装） ==========
           SOURCES_FILE="/etc/apt/sources.list.d/debian.sources"
           if [ -f "${SOURCES_FILE}" ]; then
-            sed -i "s|http://deb.debian.org/debian|${APT_MIRROR_DEBIAN}|g" "${SOURCES_FILE}"
-            sed -i "s|http://deb.debian.org/debian-security|${APT_MIRROR_DEBIAN_SECURITY}|g" "${SOURCES_FILE}"
-            sed -i "s|https://deb.debian.org/debian|${APT_MIRROR_DEBIAN}|g" "${SOURCES_FILE}"
-            sed -i "s|https://deb.debian.org/debian-security|${APT_MIRROR_DEBIAN_SECURITY}|g" "${SOURCES_FILE}"
+            sed -i "s|http://deb.debian.org/debian|${APT_MIRROR_DEBIAN_HTTP}|g" "${SOURCES_FILE}"
+            sed -i "s|http://deb.debian.org/debian-security|${APT_MIRROR_DEBIAN_SECURITY_HTTP}|g" "${SOURCES_FILE}"
+            sed -i "s|https://deb.debian.org/debian|${APT_MIRROR_DEBIAN_HTTP}|g" "${SOURCES_FILE}"
+            sed -i "s|https://deb.debian.org/debian-security|${APT_MIRROR_DEBIAN_SECURITY_HTTP}|g" "${SOURCES_FILE}"
           else
-            # 兜底旧格式 /etc/apt/sources.list
             if [ -f /etc/apt/sources.list ]; then
-              sed -i "s|http://deb.debian.org/debian|${APT_MIRROR_DEBIAN}|g" /etc/apt/sources.list
-              sed -i "s|https://deb.debian.org/debian|${APT_MIRROR_DEBIAN}|g" /etc/apt/sources.list
-              sed -i "s|http://security.debian.org/debian-security|${APT_MIRROR_DEBIAN_SECURITY}|g" /etc/apt/sources.list
-              sed -i "s|https://security.debian.org/debian-security|${APT_MIRROR_DEBIAN_SECURITY}|g" /etc/apt/sources.list
+              sed -i "s|http://deb.debian.org/debian|${APT_MIRROR_DEBIAN_HTTP}|g" /etc/apt/sources.list
+              sed -i "s|https://deb.debian.org/debian|${APT_MIRROR_DEBIAN_HTTP}|g" /etc/apt/sources.list
+              sed -i "s|http://security.debian.org/debian-security|${APT_MIRROR_DEBIAN_SECURITY_HTTP}|g" /etc/apt/sources.list
+              sed -i "s|https://security.debian.org/debian-security|${APT_MIRROR_DEBIAN_SECURITY_HTTP}|g" /etc/apt/sources.list
             fi
           fi
           apt-get update -qq
-          DEBIAN_FRONTEND=noninteractive apt-get install -yqq --no-install-recommends \
-            git ca-certificates curl
+          DEBIAN_FRONTEND=noninteractive apt-get install -yqq --no-install-recommends ca-certificates
+          update-ca-certificates 2>/dev/null || true
+
+          # ========== Step 1：现在有了证书，换成 HTTPS 清华源（更安全）+ 装 git/curl ==========
+          if [ -f "${SOURCES_FILE}" ]; then
+            sed -i "s|${APT_MIRROR_DEBIAN_HTTP}|${APT_MIRROR_DEBIAN}|g" "${SOURCES_FILE}"
+            sed -i "s|${APT_MIRROR_DEBIAN_SECURITY_HTTP}|${APT_MIRROR_DEBIAN_SECURITY}|g" "${SOURCES_FILE}"
+          else
+            if [ -f /etc/apt/sources.list ]; then
+              sed -i "s|${APT_MIRROR_DEBIAN_HTTP}|${APT_MIRROR_DEBIAN}|g" /etc/apt/sources.list
+              sed -i "s|${APT_MIRROR_DEBIAN_SECURITY_HTTP}|${APT_MIRROR_DEBIAN_SECURITY}|g" /etc/apt/sources.list
+            fi
+          fi
+          apt-get update -qq
+          DEBIAN_FRONTEND=noninteractive apt-get install -yqq --no-install-recommends git curl
           rm -rf /var/lib/apt/lists/*
-          # 全局 git 代理：任何 git clone/fetch/pull https://github.com/... 自动走 gh-proxy.com 前缀
+          # 全局 git 代理：任何 git clone/fetch/pull https://github.com/... 自动走 gh-proxy 前缀
           git config --system url."${GH_PROXY_PREFIX}https://github.com/".insteadOf "https://github.com/" || true
           git --version
           node -v
@@ -116,19 +134,31 @@ jobs:
       - name: 系统环境准备（Ubuntu 22.04 默认镜像源换清华 + 全局 GitHub gh-proxy）
         run: |
           set -euxo pipefail
+          # ========== Step 0：先装 ca-certificates（默认 HTTP archive.ubuntu.com 不需要证书，解鸡生蛋） ==========
+          if command -v apt-get >/dev/null 2>&1; then
+            sudo apt-get update -qq 2>/dev/null || apt-get update -qq 2>/dev/null || true
+            sudo DEBIAN_FRONTEND=noninteractive apt-get install -yqq --no-install-recommends ca-certificates 2>/dev/null || \
+              DEBIAN_FRONTEND=noninteractive apt-get install -yqq --no-install-recommends ca-certificates 2>/dev/null || true
+            sudo update-ca-certificates 2>/dev/null || update-ca-certificates 2>/dev/null || true
+          fi
+
+          # ========== Step 1：有了证书后换 HTTPS 清华源 ==========
           # Ubuntu 22.04 默认是 http://archive.ubuntu.com/ubuntu 和 http://security.ubuntu.com/ubuntu
           if command -v apt-get >/dev/null 2>&1 && [ -f /etc/apt/sources.list ]; then
             sudo sed -i \
-              -e 's|http://archive.ubuntu.com/ubuntu|https://mirrors.tuna.tsinghua.edu.cn/ubuntu|g' \
-              -e 's|http://security.ubuntu.com/ubuntu|https://mirrors.tuna.tsinghua.edu.cn/ubuntu-security|g' \
-              -e 's|https://archive.ubuntu.com/ubuntu|https://mirrors.tuna.tsinghua.edu.cn/ubuntu|g' \
+              -e 's|http://archive.ubuntu.com/ubuntu|'"${APT_MIRROR_UBUNTU}"'|g' \
+              -e 's|http://security.ubuntu.com/ubuntu|'"${APT_MIRROR_UBUNTU_SECURITY}"'|g' \
+              -e 's|https://archive.ubuntu.com/ubuntu|'"${APT_MIRROR_UBUNTU}"'|g' \
+              -e 's|https://security.ubuntu.com/ubuntu|'"${APT_MIRROR_UBUNTU_SECURITY}"'|g' \
               /etc/apt/sources.list
           fi
           if command -v apt-get >/dev/null 2>&1 && ls /etc/apt/sources.list.d/*.sources 1>/dev/null 2>&1; then
             for f in /etc/apt/sources.list.d/*.sources; do
               sudo sed -i \
-                -e 's|http://archive.ubuntu.com/ubuntu|https://mirrors.tuna.tsinghua.edu.cn/ubuntu|g' \
-                -e 's|http://security.ubuntu.com/ubuntu|https://mirrors.tuna.tsinghua.edu.cn/ubuntu-security|g' \
+                -e 's|http://archive.ubuntu.com/ubuntu|'"${APT_MIRROR_UBUNTU}"'|g' \
+                -e 's|http://security.ubuntu.com/ubuntu|'"${APT_MIRROR_UBUNTU_SECURITY}"'|g' \
+                -e 's|https://archive.ubuntu.com/ubuntu|'"${APT_MIRROR_UBUNTU}"'|g' \
+                -e 's|https://security.ubuntu.com/ubuntu|'"${APT_MIRROR_UBUNTU_SECURITY}"'|g' \
                 "${f}" 2>/dev/null || true
             done
           fi