diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 40c86ad..dda3a9f 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -509,6 +509,64 @@ jobs:
       image_full: ${{ needs.meta-warmup.outputs.image_full }}
       image_latest: ${{ needs.meta-warmup.outputs.image_latest }}
     steps:
+      - name: 检出代码
+        run: |
+          set -euxo pipefail
+          REPO_URL="https://${GITEA_HOST}/${GITHUB_REPOSITORY}.git"
+          BRANCH="${GITHUB_REF_NAME:-main}"
+          git clone --depth 1 -b "${BRANCH}" "${REPO_URL}" .
+
+      - name: 初始化 Docker Buildx builder (为本作业重新创建)
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.actor }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN || github.token }}
+        run: |
+          set -euxo pipefail
+          if [ -z "${REGISTRY_TOKEN}" ]; then
+            echo "ERROR: REGISTRY_TOKEN 为空。请在 Repository Secrets 中新建 REGISTRY_TOKEN"
+            exit 1
+          fi
+          REGISTRY_USER="${REGISTRY_USER,,}"
+          BUILDER_NAME="multi"
+          BUILDKIT_IMAGE="moby/buildkit:buildx-stable-1"
+          BKK_CFG="$(mktemp -t buildkitd_XXXXXX.toml)"
+          {
+            printf '[worker.oci]\n  max-parallelism = 2\n\n'
+            printf '[registry."docker.io"]\n  mirrors = ["docker.m.daocloud.io","dockerproxy.com","hub-mirror.c.163.com","docker.nju.edu.cn","docker.mirrors.ustc.edu.cn"]\n\n'
+            printf '[registry."ghcr.io"]\n  mirrors = ["ghcr.nju.edu.cn","ghcr.dockerproxy.com"]\n\n'
+            printf '[registry."k8s.gcr.io"]\n  mirrors = ["k8s-gcr.m.daocloud.io","registry.cn-hangzhou.aliyuncs.com/google_containers"]\n\n'
+            printf '[registry."%s"]\n  username = "%s"\n  password = "%s"\n' "${GITEA_HOST}" "${REGISTRY_USER}" "${REGISTRY_TOKEN}"
+          } > "${BKK_CFG}"
+          PULLED=0
+          for MIRROR in \
+            "docker.m.daocloud.io/${BUILDKIT_IMAGE}" \
+            "dockerproxy.com/${BUILDKIT_IMAGE}" \
+            "hub-mirror.c.163.com/${BUILDKIT_IMAGE}" \
+            "docker.nju.edu.cn/${BUILDKIT_IMAGE}" \
+            "docker.mirrors.ustc.edu.cn/${BUILDKIT_IMAGE}" \
+            "${BUILDKIT_IMAGE}"; do
+            if docker pull "${MIRROR}" 2>/dev/null; then
+              if [ "${MIRROR}" != "${BUILDKIT_IMAGE}" ]; then
+                docker tag "${MIRROR}" "${BUILDKIT_IMAGE}" 2>/dev/null || true
+              fi
+              PULLED=1
+              break
+            fi
+          done
+          [ "${PULLED}" = "1" ] || { echo "ERROR: 无法拉取 buildkitd 基础镜像"; exit 1; }
+          printf '%s' "${REGISTRY_TOKEN}" | docker login "${GITEA_HOST}" -u "${REGISTRY_USER}" --password-stdin
+          docker buildx rm "${BUILDER_NAME}" 2>/dev/null || true
+          docker buildx create \
+            --name "${BUILDER_NAME}" \
+            --driver docker-container \
+            --use \
+            --config "${BKK_CFG}" \
+            --buildkitd-flags '--allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host' \
+            --driver-opt network=host \
+            --driver-opt "image=${BUILDKIT_IMAGE}"
+          rm -f "${BKK_CFG}"
+          docker buildx inspect --bootstrap
+
       - name: 复用 meta-warmup 结果（与 Preflight 并发省 ~5min）
         run: |
           set -euo pipefail
@@ -522,8 +580,6 @@ jobs:
           echo "[meta-warmup] image_latest=${{ needs.meta-warmup.outputs.image_latest }}"
           echo "[meta-warmup] repo_owner=${{ needs.meta-warmup.outputs.repo_owner }}"
           echo "[meta-warmup] repo_name=${{ needs.meta-warmup.outputs.repo_name }}"
-          docker buildx use multi
-          docker buildx inspect
 
       - name: 构建并推送镜像
         env: