diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 0c4ed26..acfbcaa 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -536,31 +536,57 @@ jobs:
           # 本地预检查：ssh 先连上跑 whoami 确认连通，避免 20 分钟后才发现连不上
           ssh "${SSH_OPTS[@]}" "${DEPLOY_USER}@${DEPLOY_HOST}" "whoami; docker --version; docker compose version"
 
-          # 把变量作为 heredoc 脚本的输入传过去，远端展开我们需要的值
+          # 关键修复：远端 bash 前置 ENV=val 语法在 dash/sh 远端不认，
+          # 改为先把变量用 printf 写到远端 /tmp/deploy_env.$$ 再远端 source 它，100% 可靠
+          ENV_SH="/tmp/deploy_env_$$"
+          # 注意：${IMAGE_NEW} / ${DEPLOY_PATH} 等在本地 shell 展开，不是远端，所以 heredoc 用 "" 双引号
+          ssh "${SSH_OPTS[@]}" "${DEPLOY_USER}@${DEPLOY_HOST}" "cat > ${ENV_SH}" <<ENV_SH_EOF
+export IMAGE_NEW="${IMAGE_NEW}"
+export IMAGE_LATEST="${IMAGE_LATEST}"
+export DEPLOY_PATH="${DEPLOY_PATH}"
+export GITEA_HOST="${GITEA_HOST}"
+export GH_PROXY_PREFIX="${GH_PROXY_PREFIX}"
+export REGISTRY_PULL_USER="${REGISTRY_PULL_USER}"
+export REGISTRY_PULL_TOKEN="${REGISTRY_PULL_TOKEN}"
+export IMAGE_NAME="${IMAGE_NAME}"
+export NUXT_PUBLIC_SITE_URL="${NUXT_PUBLIC_SITE_URL}"
+export GITHUB_SERVER_URL="${GITHUB_SERVER_URL}"
+export GITHUB_REPOSITORY="${GITHUB_REPOSITORY}"
+export GITHUB_REF_NAME="${GITHUB_REF_NAME}"
+ENV_SH_EOF
+          echo "[Deploy] env script written to ${ENV_SH} on remote"
+
           ssh "${SSH_OPTS[@]}" "${DEPLOY_USER}@${DEPLOY_HOST}" \
-            IMAGE_NEW="${IMAGE_NEW}" \
-            IMAGE_LATEST="${IMAGE_LATEST}" \
-            DEPLOY_PATH="${DEPLOY_PATH}" \
-            GITEA_HOST="${GITEA_HOST}" \
-            GH_PROXY_PREFIX="${GH_PROXY_PREFIX}" \
-            REGISTRY_PULL_USER="${REGISTRY_PULL_USER}" \
-            REGISTRY_PULL_TOKEN="${REGISTRY_PULL_TOKEN}" \
-            IMAGE_NAME="${IMAGE_NAME}" \
-            NUXT_PUBLIC_SITE_URL="${NUXT_PUBLIC_SITE_URL}" \
-            GITHUB_SERVER_URL="${GITHUB_SERVER_URL}" \
-            GITHUB_REPOSITORY="${GITHUB_REPOSITORY}" \
-            GITHUB_REF_NAME="${GITHUB_REF_NAME}" \
-            bash <<'REMOTE_SCRIPT'
+            "chmod +x ${ENV_SH} && bash -c 'source ${ENV_SH} && rm -f ${ENV_SH}'" <<'REMOTE_SCRIPT'
+              # 注意：上面 source 的环境变量会自动继承到后面的 REMOTE_SCRIPT bash 子进程中
+              true
+REMOTE_SCRIPT
+
+          # 再次用 bash 显式 source env，然后执行真正的 deploy 脚本（双源保证）
+          ssh "${SSH_OPTS[@]}" "${DEPLOY_USER}@${DEPLOY_HOST}" "bash -s -- ${ENV_SH}" <<'REMOTE_SCRIPT_MAIN'
               set -euxo pipefail
+              ENV_SH="$1"
+              if [ -f "$ENV_SH" ]; then
+                # shellcheck disable=SC1090
+                . "$ENV_SH"
+                rm -f "$ENV_SH"
+              fi
 
               DEPLOY_DIR="${DEPLOY_PATH}"
               COMPOSE="docker compose"
 
               echo "=============================================="
               echo "Executor     : $(whoami)"
-              echo "Deploy image : ${IMAGE_NEW}"
-              echo "Deploy dir   : ${DEPLOY_DIR}"
+              echo "IMAGE_NEW    : ${IMAGE_NEW:-(empty!)}"
+              echo "DEPLOY_DIR   : ${DEPLOY_DIR:-(empty!)}"
               echo "=============================================="
+              # 防御性断言：镜像名 / 路径不能为空，否则直接 exit 9 避免起旧容器
+              if [ -z "${IMAGE_NEW}" ] || [ -z "${DEPLOY_DIR}" ]; then
+                echo "ERROR: IMAGE_NEW or DEPLOY_DIR is empty — env variables not propagated correctly."
+                echo "IMAGE_NEW=${IMAGE_NEW}"
+                echo "DEPLOY_DIR=${DEPLOY_DIR}"
+                exit 9
+              fi
 
               mkdir -p "${DEPLOY_DIR}" 2>/dev/null || sudo mkdir -p "${DEPLOY_DIR}" 2>/dev/null || true
               cd "${DEPLOY_DIR}"
@@ -665,7 +691,7 @@ jobs:
               echo "   printf 'services:\\n  voicehub:\\n    image: <OLD_TAG_FROM_ABOVE>\\n' > docker-compose.override.yml"
               echo "   docker compose up -d"
               echo "================================================================="
-          REMOTE_SCRIPT
+          REMOTE_SCRIPT_MAIN
 
           # 清理私钥临时文件
           rm -f "${SSH_KEY_FILE}"