diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 4c49264..6ea41c0 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -57,7 +57,8 @@ jobs:
           sed -i 's|deb.debian.org|mirrors.tuna.tsinghua.edu.cn|g' /etc/apt/sources.list /etc/apt/sources.list.d/*.list 2>/dev/null || true
           sed -i 's|security.debian.org|mirrors.tuna.tsinghua.edu.cn/debian-security|g' /etc/apt/sources.list /etc/apt/sources.list.d/*.list 2>/dev/null || true
           apt-get update -qq
-          apt-get install -y -qq docker.io
+          # 顺手装 git：拉取代码那步要用，ubuntu-latest 默认不带
+          apt-get install -y -qq docker.io git ca-certificates
           # 装完之后让 daemon 重新读上面三处配置；不同启动方式都试一遍
           systemctl daemon-reload 2>/dev/null || true
           systemctl restart docker 2>/dev/null || service docker restart 2>/dev/null || true
@@ -65,8 +66,13 @@ jobs:
           sleep 3
 
       - name: 拉取代码
-        # 走 gitea.com 镜像，避免裸连 github.com 偶发 unexpected EOF
-        uses: https://gitea.com/actions/checkout@v4
+        # 直接走局域网 gitea，不再依赖任何外网 action mirror
+        run: |
+          git init
+          git remote add origin http://git.ymxixi.space/adminym/telegram-downloader.git
+          # 优先按本次触发的 commit SHA 拉，确保部署的是 push 上来的那次
+          git fetch --depth 1 origin "$GITHUB_SHA"
+          git checkout FETCH_HEAD
 
       - name: 构建镜像
         run: docker build -t telegram-downloader:latest .