diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 3065ab8..93eb532 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -69,7 +69,14 @@ jobs:
       - name: Login to Docker Registry
         run: |
           set -euo pipefail
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "$REGISTRY" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          USER="${{ secrets.REGISTRY_USERNAME }}"
+          PASS="${{ secrets.REGISTRY_PASSWORD }}"
+          if [ -z "$USER" ] || [ -z "$PASS" ]; then
+            echo "ERROR: REGISTRY_USERNAME / REGISTRY_PASSWORD 未配置或为空"
+            echo "请在 Gitea 仓库 Settings → Secrets 中配置后重试"
+            exit 1
+          fi
+          echo "$PASS" | docker login "$REGISTRY" -u "$USER" --password-stdin
 
       - name: Build & Push Docker image
         run: |
@@ -104,25 +111,56 @@ jobs:
       - name: Setup kubectl
         run: |
           set -euo pipefail
+          if [ -z "${{ secrets.KUBECONFIG_B64 }}" ]; then
+            echo "ERROR: KUBECONFIG_B64 未配置或为空"
+            exit 1
+          fi
           curl -sLO "https://dl.k8s.io/release/v1.30.0/bin/linux/amd64/kubectl"
           chmod +x kubectl
           mv kubectl /usr/local/bin/
           echo "${{ secrets.KUBECONFIG_B64 }}" | base64 -d > /tmp/kubeconfig
+          kubectl --kubeconfig=/tmp/kubeconfig cluster-info >/dev/null
 
       - name: Create/Update imagePullSecret
         run: |
           set -euo pipefail
+          ENV="${{ inputs.environment }}"
+          NS="lpt-$ENV"
+          USER="${{ secrets.REGISTRY_USERNAME }}"
+          PASS="${{ secrets.REGISTRY_PASSWORD }}"
+          if [ -z "$USER" ] || [ -z "$PASS" ]; then
+            echo "ERROR: REGISTRY_USERNAME / REGISTRY_PASSWORD 为空，无法创建 regcred"
+            exit 1
+          fi
+          # 确保 namespace 存在
+          kubectl --kubeconfig=/tmp/kubeconfig get ns "$NS" >/dev/null 2>&1 \
+            || kubectl --kubeconfig=/tmp/kubeconfig create ns "$NS"
+          # 删除旧 secret 再重建，避免 type/字段残留
+          kubectl --kubeconfig=/tmp/kubeconfig delete secret regcred -n "$NS" --ignore-not-found
           kubectl --kubeconfig=/tmp/kubeconfig create secret docker-registry regcred \
             --docker-server="$REGISTRY" \
-            --docker-username="${{ secrets.REGISTRY_USERNAME }}" \
-            --docker-password="${{ secrets.REGISTRY_PASSWORD }}" \
-            -n "lpt-${{ inputs.environment }}" \
-            --dry-run=client -o yaml | kubectl --kubeconfig=/tmp/kubeconfig apply -f -
+            --docker-username="$USER" \
+            --docker-password="$PASS" \
+            -n "$NS"
+          # 校验 .dockerconfigjson 非空
+          LEN=$(kubectl --kubeconfig=/tmp/kubeconfig get secret regcred -n "$NS" \
+            -o jsonpath='{.data.\.dockerconfigjson}' | wc -c)
+          if [ "${LEN// /}" -lt 10 ]; then
+            echo "ERROR: regcred 创建后 .dockerconfigjson 异常（len=$LEN）"
+            exit 1
+          fi
+          echo "regcred OK in $NS (dockerconfigjson len≈$LEN)"
+          # 强制 Deployment 使用 imagePullSecrets（集群存量可能缺失）
+          kubectl --kubeconfig=/tmp/kubeconfig patch deployment "$APP" -n "$NS" \
+            --type=strategic \
+            -p '{"spec":{"template":{"spec":{"imagePullSecrets":[{"name":"regcred"}]}}}}'
+          echo "patched deployment/$APP imagePullSecrets=regcred"
 
       - name: Deploy to K8s
         run: |
           set -euo pipefail
           ENV="${{ inputs.environment }}"
+          NS="lpt-$ENV"
           IMAGE_TAG="${IMAGE_TAG:-}"
           if [ -z "$IMAGE_TAG" ] && [ -f image_tag.txt ]; then
             IMAGE_TAG="$(cat image_tag.txt)"
@@ -134,33 +172,48 @@ jobs:
             echo "ERROR: IMAGE_TAG 为空，无法部署"
             exit 1
           fi
-          echo "Deploying $REGISTRY/$APP:$IMAGE_TAG -> namespace lpt-$ENV"
+          # 确认 Deployment 已挂 regcred
+          PULL_SECRET=$(kubectl --kubeconfig=/tmp/kubeconfig get deployment "$APP" -n "$NS" \
+            -o jsonpath='{.spec.template.spec.imagePullSecrets[0].name}' 2>/dev/null || true)
+          if [ "$PULL_SECRET" != "regcred" ]; then
+            echo "ERROR: deployment/$APP 未配置 imagePullSecrets=regcred（当前='$PULL_SECRET'）"
+            exit 1
+          fi
+          echo "Deploying $REGISTRY/$APP:$IMAGE_TAG -> namespace $NS"
           kubectl --kubeconfig=/tmp/kubeconfig set image "deployment/$APP" \
             "$APP=$REGISTRY/$APP:$IMAGE_TAG" \
-            -n "lpt-$ENV" --record
+            -n "$NS" --record
           kubectl --kubeconfig=/tmp/kubeconfig rollout status "deployment/$APP" \
-            -n "lpt-$ENV" --timeout=5m
+            -n "$NS" --timeout=5m
 
       - name: Debug on failure
         if: failure()
         run: |
           ENV="${{ inputs.environment }}"
+          NS="lpt-$ENV"
           echo "=== Deployment Status ==="
-          kubectl --kubeconfig=/tmp/kubeconfig get deployment "$APP" -n "lpt-$ENV" || true
+          kubectl --kubeconfig=/tmp/kubeconfig get deployment "$APP" -n "$NS" -o wide || true
+          echo ""
+          echo "=== imagePullSecrets on Deployment ==="
+          kubectl --kubeconfig=/tmp/kubeconfig get deployment "$APP" -n "$NS" \
+            -o jsonpath='{.spec.template.spec.imagePullSecrets}' || true
+          echo ""
+          echo "=== regcred secret ==="
+          kubectl --kubeconfig=/tmp/kubeconfig get secret regcred -n "$NS" -o yaml 2>&1 | head -20 || true
           echo ""
           echo "=== Pod Status ==="
-          kubectl --kubeconfig=/tmp/kubeconfig get pods -n "lpt-$ENV" -l "app=$APP" || true
+          kubectl --kubeconfig=/tmp/kubeconfig get pods -n "$NS" -l "app=$APP" || true
           echo ""
           echo "=== Recent Events ==="
-          kubectl --kubeconfig=/tmp/kubeconfig get events -n "lpt-$ENV" --sort-by='.lastTimestamp' | tail -20 || true
+          kubectl --kubeconfig=/tmp/kubeconfig get events -n "$NS" --sort-by='.lastTimestamp' | tail -20 || true
           echo ""
           echo "=== Pod Describe (latest) ==="
-          POD=$(kubectl --kubeconfig=/tmp/kubeconfig get pods -n "lpt-$ENV" -l "app=$APP" --sort-by=.metadata.creationTimestamp -o jsonpath='{.items[-1].metadata.name}' 2>/dev/null || true)
+          POD=$(kubectl --kubeconfig=/tmp/kubeconfig get pods -n "$NS" -l "app=$APP" --sort-by=.metadata.creationTimestamp -o jsonpath='{.items[-1].metadata.name}' 2>/dev/null || true)
           if [ -n "${POD:-}" ]; then
-            kubectl --kubeconfig=/tmp/kubeconfig describe pod "$POD" -n "lpt-$ENV" || true
+            kubectl --kubeconfig=/tmp/kubeconfig describe pod "$POD" -n "$NS" || true
             echo ""
             echo "=== Pod Logs (latest) ==="
-            kubectl --kubeconfig=/tmp/kubeconfig logs "$POD" -n "lpt-$ENV" --tail=50 || true
+            kubectl --kubeconfig=/tmp/kubeconfig logs "$POD" -n "$NS" --tail=50 || true
           fi
 
       - name: Rollback on failure