diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 327ef30..60e5d4d 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -178,13 +178,47 @@ jobs:
           git clone --depth 1 -b "${BRANCH}" "${REPO_URL}" .
           git rev-parse --short HEAD
 
-      - name: 安装依赖（npm ci）
+      - name: 安装依赖（npm ci，含网络超时兜底：双 registry 切换 + 3 次重试 + fetch-retires 5 次 + 5 分钟 fetch-timeout）
         run: |
-          set -euxo pipefail
-          npm config set registry https://registry.npmmirror.com || true
-          npm config set fund false
-          npm config set audit false
-          npm ci --legacy-peer-deps
+          set -euo pipefail
+          # npmmirror 双域名容错（主站 registry.npmmirror.com + 腾讯云镜像 mirrors.cloud.tencent.com/npm/，两套独立 CDN 节点）
+          NPM_REGISTRY_PRIMARY="${NPM_REGISTRY_PRIMARY:-https://registry.npmmirror.com}"
+          NPM_REGISTRY_FALLBACK="${NPM_REGISTRY_FALLBACK:-https://mirrors.cloud.tencent.com/npm/}"
+          MAX_RETRY=3
+          DELAY_SEC=15
+          CI_OK=0
+          for ATTEMPT in $(seq 1 $MAX_RETRY); do
+            # 奇数次用主站、偶数次切备用域名（npmmirror 主站 429/超时/断流时兜底，避免一直卡一个节点）
+            if [ $(( ATTEMPT % 2 )) -eq 1 ]; then
+              CUR_REGISTRY="${NPM_REGISTRY_PRIMARY}"
+            else
+              CUR_REGISTRY="${NPM_REGISTRY_FALLBACK}"
+            fi
+            echo "--- [npm ci attempt $ATTEMPT/$MAX_RETRY] registry=${CUR_REGISTRY} ---"
+            npm config set registry "${CUR_REGISTRY}" || true
+            npm config set fund false
+            npm config set audit false
+            npm config set prefer-offline true 2>/dev/null || true
+            npm config set cache-min 3600 2>/dev/null || true
+            # fetch-retries: npm 内部单次请求失败重试（read ETIMEDOUT / ECONNRESET 等网络抖动）
+            npm config set fetch-retries 5 2>/dev/null || true
+            # fetch-timeout=300000ms（5 分钟）：esbuild/@swc 等大型原生 prebuilt 包慢链路时避免 30s 读超时
+            npm config set fetch-retry-maxtimeout 300000 2>/dev/null || true
+            npm config set fetch-timeout 300000 2>/dev/null || true
+            npm config set fetch-retry-mintimeout 20000 2>/dev/null || true
+            if npm ci --legacy-peer-deps; then
+              CI_OK=1
+              echo "[npm ci] attempt ${ATTEMPT} SUCCESS"
+              break
+            fi
+            echo "[npm ci] attempt ${ATTEMPT} FAILED（exit=$?），${DELAY_SEC}s 后重试下一轮（若还有）..."
+            sleep $DELAY_SEC
+          done
+          if [ "${CI_OK}" != "1" ]; then
+            echo "ERROR: npm ci 经过 ${MAX_RETRY} 轮（主站/备用域名交替）仍失败，请检查 Runner 网络是否能访问 ${NPM_REGISTRY_PRIMARY} / ${NPM_REGISTRY_FALLBACK}" >&2
+            echo "  可在 Variables 中覆盖 NPM_REGISTRY_PRIMARY / NPM_REGISTRY_FALLBACK，或在 Runner 宿主机手动配 npm 代理" >&2
+            exit 1
+          fi
 
       - name: 检查 package.json 无 pnpm 残留
         run: |
@@ -497,7 +531,7 @@ jobs:
   deploy:
     name: 部署到生产服务器
     needs: build-image
-    if: ${{ !cancelled() && !failure() && (github.event_name == 'push' || inputs.deploy_target == true) }}
+    if: always() && needs.build-image.result == 'success' && (github.event_name == 'push' || inputs.deploy_target == true)
     runs-on: ubuntu-latest
     timeout-minutes: 25
     environment: