diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 67abae7..91f298d 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -25,6 +25,7 @@ jobs:
         - maven-cache:/root/.m2
     steps:
       - name: Validate branch ↔ environment
+        shell: bash
         run: |
           set -euo pipefail
           REF="${{ gitea.ref }}"
@@ -64,6 +65,7 @@ jobs:
           esac
 
       - name: Checkout code
+        shell: bash
         run: |
           set -euo pipefail
           # maven 容器可能无 git
@@ -75,6 +77,7 @@ jobs:
           git checkout "${{ gitea.sha }}"
 
       - name: Install Docker CLI
+        shell: bash
         run: |
           set -euo pipefail
           apt-get update -qq
@@ -82,16 +85,19 @@ jobs:
           docker --version
 
       - name: Build with Maven
+        shell: bash
         run: |
           set -euo pipefail
           mvn clean package -DskipTests -B
 
       - name: Login to Docker Registry
+        shell: bash
         run: |
           set -euo pipefail
           echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "$REGISTRY" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
 
       - name: Build & Push Docker image
+        shell: bash
         run: |
           set -euo pipefail
           ENV="${{ inputs.environment }}"
@@ -106,13 +112,13 @@ jobs:
           if [ -n "${GITEA_ENV:-}" ]; then
             echo "IMAGE_TAG=$TAG" >> "$GITEA_ENV"
           fi
-          # runner.temp 在 container job 里可能不可用，用工作区文件兜底
           echo "$TAG" > image_tag.txt
           mkdir -p /tmp/lpt-ci
           echo "$TAG" > /tmp/lpt-ci/image_tag.txt
           echo "IMAGE_TAG=$TAG"
 
       - name: Setup kubectl
+        shell: bash
         run: |
           set -euo pipefail
           curl -sLO "https://dl.k8s.io/release/v1.30.0/bin/linux/amd64/kubectl"
@@ -122,6 +128,7 @@ jobs:
           echo "${{ secrets.KUBECONFIG_B64 }}" | base64 -d > ~/.kube/config
 
       - name: Create/Update imagePullSecret
+        shell: bash
         run: |
           set -euo pipefail
           kubectl create secret docker-registry regcred \
@@ -132,6 +139,7 @@ jobs:
             --dry-run=client -o yaml | kubectl apply -f -
 
       - name: Deploy to K8s
+        shell: bash
         run: |
           set -euo pipefail
           ENV="${{ inputs.environment }}"
@@ -156,6 +164,7 @@ jobs:
 
       - name: Debug on failure
         if: failure()
+        shell: bash
         run: |
           ENV="${{ inputs.environment }}"
           echo "=== Deployment Status ==="
@@ -178,6 +187,7 @@ jobs:
 
       - name: Rollback on failure
         if: failure()
+        shell: bash
         run: |
           set -euo pipefail
           ENV="${{ inputs.environment }}"