diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 4077b1c..d803c3a 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -163,6 +163,8 @@ jobs:
           # ========== 关键修复：宿主机 Docker daemon 先注入国内 registry mirrors ==========
           # 原因：Runner 任何 docker pull / buildx create（moby/buildkit 拉基础镜像）都要先经过 daemon
           # 如果直接连 docker.io，国内会被限速到 <200KB/s，导致 Setup / BuildKit 拉镜像一直卡。
+          # 注意：此处用 PY_CODE 字符串 + printf 管道传 Python 代码给 stdin，
+          #   避免 <<'PY' heredoc 结构与 YAML run:| 块标量缩进冲突导致的 could not find expected ':' 报错。
           DOCKER_DAEMON_CONF="/etc/docker/daemon.json"
           if command -v docker >/dev/null 2>&1 && command -v sudo >/dev/null 2>&1; then
             sudo mkdir -p /etc/docker 2>/dev/null || true
@@ -170,27 +172,23 @@ jobs:
             if [ -f "${DOCKER_DAEMON_CONF}" ]; then
               OLD_MIRRORS_JSON="$(sudo cat "${DOCKER_DAEMON_CONF}" 2>/dev/null || echo "{}")"
             fi
-            # 用 python3 合成合法 JSON（避免 bash 手搓 JSON 转义坑）
-            NEW_DAEMON_JSON="$(
-              python3 - "$OLD_MIRRORS_JSON" \
-                "${DOCKER_REGISTRY_MIRROR_1}" "${DOCKER_REGISTRY_MIRROR_2}" "${DOCKER_REGISTRY_MIRROR_3}" <<'PY'
-import json, sys
-try:
-    data = json.loads(sys.argv[1] or "{}")
-except Exception:
-    data = {}
-mirrors_envs = [m for m in sys.argv[2:5] if m]
-existing = data.get("registry-mirrors") or []
-if isinstance(existing, list):
-    combined = list(dict.fromkeys([*mirrors_envs, *existing]))
-else:
-    combined = mirrors_envs
-if combined:
-    data["registry-mirrors"] = combined
-data.setdefault("log-driver", "json-file")
-print(json.dumps(data, ensure_ascii=False, indent=2))
-PY
-            )"
+            PY_CODE='            import json, sys
+            try:
+                data = json.loads(sys.argv[1] or "{}")
+            except Exception:
+                data = {}
+            mirrors_envs = [m for m in sys.argv[2:5] if m]
+            existing = data.get("registry-mirrors") or []
+            if isinstance(existing, list):
+                combined = list(dict.fromkeys([*mirrors_envs, *existing]))
+            else:
+                combined = mirrors_envs
+            if combined:
+                data["registry-mirrors"] = combined
+            data.setdefault("log-driver", "json-file")
+            print(json.dumps(data, ensure_ascii=False, indent=2))'
+            NEW_DAEMON_JSON="$(printf '%s\n' "$PY_CODE" | python3 - "$OLD_MIRRORS_JSON" \
+              "${DOCKER_REGISTRY_MIRROR_1}" "${DOCKER_REGISTRY_MIRROR_2}" "${DOCKER_REGISTRY_MIRROR_3}")"
             echo "${NEW_DAEMON_JSON}" | sudo tee "${DOCKER_DAEMON_CONF}" >/dev/null
             echo "[Docker] daemon.json 已注入 registry-mirrors:"
             sudo cat "${DOCKER_DAEMON_CONF}" 2>/dev/null || true