diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 06553ca..fd5921b 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -209,9 +209,18 @@ jobs:
           echo "Cache ref    : ${CACHE_REF_INNER}"
           echo "======================================"
 
-      - name: 初始化 Docker Buildx builder（带国内 registry-mirrors + gh-proxy 环境）
+      - name: 初始化 Docker Buildx builder（带国内 registry-mirrors + 内置 Gitea Basic Auth）
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.actor }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN || github.token }}
         run: |
           set -euxo pipefail
+          # 先校验凭据非空（避免 buildkitd.toml 写空用户名/密码导致 push 时 401）
+          if [ -z "${REGISTRY_TOKEN}" ]; then
+            echo "ERROR: REGISTRY_TOKEN 为空。请在 Repository Secrets 中新建 REGISTRY_TOKEN（个人应用令牌，权限 read:package + write:package + read:repository）"
+            exit 1
+          fi
+          REGISTRY_USER="${REGISTRY_USER,,}"
           BUILDER_NAME="multi"
           BUILDKIT_IMAGE="moby/buildkit:buildx-stable-1"
           BKK_CFG="$(mktemp -t buildkitd_XXXXXX.toml)"
@@ -220,7 +229,10 @@ jobs:
             printf '[worker.oci]\n  max-parallelism = 2\n\n'
             printf '[registry."docker.io"]\n  mirrors = ["docker.m.daocloud.io","dockerproxy.com","hub-mirror.c.163.com","docker.nju.edu.cn","docker.mirrors.ustc.edu.cn"]\n\n'
             printf '[registry."ghcr.io"]\n  mirrors = ["ghcr.nju.edu.cn","ghcr.dockerproxy.com"]\n\n'
-            printf '[registry."k8s.gcr.io"]\n  mirrors = ["k8s-gcr.m.daocloud.io","registry.cn-hangzhou.aliyuncs.com/google_containers"]\n'
+            printf '[registry."k8s.gcr.io"]\n  mirrors = ["k8s-gcr.m.daocloud.io","registry.cn-hangzhou.aliyuncs.com/google_containers"]\n\n'
+            # 关键：Gitea Container Registry 直接用 Basic Auth 凭据写死在 buildkitd.toml
+            # 绕开 buildkitd 的 OAuth2 flow（Gitea 1.27.x 有时返回空 token body：authorization server did not include a token）
+            printf '[registry."%s"]\n  username = "%s"\n  password = "%s"\n' "${GITEA_HOST}" "${REGISTRY_USER}" "${REGISTRY_TOKEN}"
           } > "${BKK_CFG}"
           # 预拉 buildkitd 基础镜像（优先 5 个国内镜像 fallback，避免 Docker Hub <200KB/s）
           PULLED=0
@@ -240,6 +252,11 @@ jobs:
             fi
           done
           [ "${PULLED}" = "1" ] || { echo "ERROR: 无法拉取 buildkitd 基础镜像，请检查 Docker registry-mirrors"; exit 1; }
+          # 宿主 Docker daemon 也同步登录（后面镜像体积与层信息 Step 的 docker image inspect / docker history 要用）
+          printf '%s' "${REGISTRY_TOKEN}" | docker login "${GITEA_HOST}" \
+            -u "${REGISTRY_USER}" --password-stdin
+          echo "宿主 Docker 登录成功：${REGISTRY_USER} @ ${GITEA_HOST}"
+          # 立即重建 buildx builder（带凭据 + registry-mirrors）
           docker buildx rm "${BUILDER_NAME}" 2>/dev/null || true
           docker buildx create \
             --name "${BUILDER_NAME}" \
@@ -257,20 +274,18 @@ jobs:
           GIT_CONFIG_VALUE_1="https://gist.github.com/"
           export GIT_CONFIG_COUNT=2 GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 GIT_CONFIG_KEY_1 GIT_CONFIG_VALUE_1
           docker buildx inspect --bootstrap
+          echo "Builder 启动成功，buildkitd.toml 已内置 ${GITEA_HOST} Basic Auth 凭据，push 不再走 OAuth2 flow"
 
-      - name: 登录 Gitea 容器仓库
-        env:
-          REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.actor }}
-          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN || github.token }}
+      - name: 确认已登录（凭据已注入 buildkitd.toml 与宿主 Docker daemon）
         run: |
           set -euo pipefail
-          if [ -z "${REGISTRY_TOKEN}" ]; then
-            echo "ERROR: REGISTRY_TOKEN 为空。请在 Repository Secrets 中新建 REGISTRY_TOKEN（权限：read:package + write:package）"
-            exit 1
-          fi
-          printf '%s' "${REGISTRY_TOKEN}" | docker login "${GITEA_HOST}" \
-            -u "${REGISTRY_USER}" --password-stdin
-          echo "登录成功：${REGISTRY_USER} @ ${GITEA_HOST}"
+          # 前面「初始化 Docker Buildx builder」Step 已完成两次登录：
+          # 1. 宿主 Docker daemon（镜像体积 Step 要用）；2. buildkitd.toml（buildx push 要用，Basic Auth 不走 OAuth2）
+          # 这里只做一个快速断言，确保宿主登录成功
+          docker info 2>/dev/null | grep -E "Username|Registry" || echo "已存在登录凭据（跳过详细输出）"
+          echo "登录确认完成，REGISTRY_USER=${REGISTRY_USER:-${GITHUB_ACTOR,,}}，GITEA_HOST=${GITEA_HOST}"
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.actor }}
 
       - name: 构建并推送镜像
         env: