diff --git a/README.md b/README.md
index b71341f..1819220 100644
--- a/README.md
+++ b/README.md
@@ -8,18 +8,18 @@ lpt-infra/
 │   ├── deployment-lpt-fe.yaml
 │   ├── deployment-lpt-be.yaml
 │   ├── deployment-lpt-ai.yaml
+│   ├── service-lpt-fe.yaml
+│   ├── service-lpt-be.yaml
 │   ├── service-lpt-ai.yaml
-│   ├── configmap.yaml
-│   ├── lpt-secrets.yaml          (template)
-│   └── regcred-secret.yaml       (template)
+│   └── configmap.yaml
 ├── prod/
 │   ├── deployment-lpt-fe.yaml
 │   ├── deployment-lpt-be.yaml
 │   ├── deployment-lpt-ai.yaml
+│   ├── service-lpt-fe.yaml
+│   ├── service-lpt-be.yaml
 │   ├── service-lpt-ai.yaml
-│   ├── configmap.yaml
-│   ├── lpt-secrets.yaml          (template)
-│   └── regcred-secret.yaml       (template)
+│   └── configmap.yaml
 └── README.md
 ```
 
@@ -31,7 +31,7 @@ kubectl create namespace lpt-dev
 kubectl create namespace lpt-prod
 ```
 
-### 2. 创建 Secret（模板不包含真实值，需手动创建）
+### 2. 创建 Secret（仅一次，由 CI/CD 自动管理）
 ```bash
 # dev
 kubectl create secret generic lpt-secrets \
@@ -60,23 +60,23 @@ kubectl create secret docker-registry regcred \
 
 ### 3. Apply 全部配置
 ```bash
-# dev
 kubectl apply -f dev/
-
-# prod
 kubectl apply -f prod/
 ```
 
-## 日常更新（CI/CD）
-
-CI/CD 流程使用 `kubectl set image` 更新镜像，仓库内 `imagePullSecrets` 已配置，无需额外操作。
+## 日常更新
 
 ```bash
-kubectl set image deployment/lpt-fe lpt-fe=192.168.123.199:5000/lpt-fe:<TAG> -n lpt-dev
-kubectl set image deployment/lpt-be lpt-be=192.168.123.199:5000/lpt-be:<TAG> -n lpt-dev
-kubectl set image deployment/lpt-ai lpt-ai=192.168.123.199:5000/lpt-ai:<TAG> -n lpt-dev
+cd ~/lpt-infra
+git pull
+kubectl apply -f dev/
+kubectl apply -f prod/
 ```
 
+## CI/CD
+
+各服务仓库的 Gitea Actions 负责 build + push 镜像，并通过 `kubectl set image` 更新 Deployment。`regcred` 由 workflow 自动 create/update，`lpt-secrets` 需手动创建一次后保持不变。
+
 ## 验证
 ```bash
 kubectl get pods -n lpt-dev
diff --git a/dev/lpt-secrets.yaml b/dev/lpt-secrets.yaml
deleted file mode 100644
index a29c292..0000000
--- a/dev/lpt-secrets.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-# LPT Application Secrets — TEMPLATE
-# DO NOT commit real secrets to git!
-#
-# Create in the cluster:
-#   kubectl create secret generic lpt-secrets \
-#     --from-literal=llm-api-key=<YOUR_LLM_API_KEY> \
-#     --from-literal=mysql-root-password=<YOUR_MYSQL_ROOT_PASSWORD> \
-#     --namespace=lpt-dev
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: lpt-secrets
-  namespace: lpt-dev
-type: Opaque
-data: {}
-# Use stringData when applying:
-# stringData:
-#   llm-api-key: "sk-xxxxxxxxxxxxxxxx"
-#   mysql-root-password: "your-mysql-password"
diff --git a/dev/regcred-secret.yaml b/dev/regcred-secret.yaml
deleted file mode 100644
index a903bd4..0000000
--- a/dev/regcred-secret.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Docker Registry Secret — TEMPLATE
-# DO NOT commit real credentials!
-#
-# Managed by Gitea Actions workflow or created manually:
-#   kubectl create secret docker-registry regcred \
-#     --docker-server=192.168.123.199:5000 \
-#     --docker-username=admin \
-#     --docker-password=<REGISTRY_PASSWORD> \
-#     --namespace=lpt-dev
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: regcred
-  namespace: lpt-dev
-type: kubernetes.io/dockerconfigjson
-data:
-  .dockerconfigjson: ""
diff --git a/prod/lpt-secrets.yaml b/prod/lpt-secrets.yaml
deleted file mode 100644
index cfa7e23..0000000
--- a/prod/lpt-secrets.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-# LPT Application Secrets — TEMPLATE
-# DO NOT commit real secrets to git!
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: lpt-secrets
-  namespace: lpt-prod
-type: Opaque
-data: {}
diff --git a/prod/regcred-secret.yaml b/prod/regcred-secret.yaml
deleted file mode 100644
index bdf36ff..0000000
--- a/prod/regcred-secret.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# Docker Registry Secret — TEMPLATE
-# DO NOT commit real credentials!
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: regcred
-  namespace: lpt-prod
-type: kubernetes.io/dockerconfigjson
-data:
-  .dockerconfigjson: ""