diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index a7f9d77..6e890df 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -28,12 +28,17 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: node:24-bookworm
+    env:
+      # 这台 runner 只保证 GITHUB_* 兼容层（GITEA_REF_NAME 等别名不可靠），
+      # 一律经表达式显式注入，不直接读 GITEA_* 环境变量
+      TAG: ${{ github.ref_name }}
+      TOKEN: ${{ secrets.GITHUB_TOKEN || secrets.GITEA_TOKEN || secrets.FORGEJO_TOKEN }}
     steps:
       # 完整历史：供 git log 生成上一个 tag 以来的变更日志
       - name: 检出代码
         run: |
           git clone "$SITE/$REPO.git" .
-          git checkout --detach "$GITEA_REF_NAME"
+          git checkout --detach "$TAG"
           git log --oneline -1
 
       - name: 安装 Go（版本取自 go.mod）
@@ -56,7 +61,7 @@ jobs:
           export PATH=/usr/local/go/bin:$PATH
           # 模块代理双层回退：官方代理不可达时走 goproxy.cn
           export GOPROXY=https://proxy.golang.org,https://goproxy.cn,direct
-          scripts/build-release.sh "${GITEA_REF_NAME}"
+          scripts/build-release.sh "$TAG"
 
       # 首个 tag 无上一版本，变更日志段自动省略
       - name: 生成发布说明
@@ -65,7 +70,7 @@ jobs:
           prev=$(git describe --tags --abbrev=0 "HEAD^" 2>/dev/null || true)
           short=$(git rev-parse --short HEAD)
           {
-            echo "## pn ${GITEA_REF_NAME}"
+            echo "## pn ${TAG}"
             echo
             echo "- commit: \`$short\`"
             echo "- 构建时间: $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
@@ -79,20 +84,18 @@ jobs:
           cat release-notes.md
 
       - name: 创建 Release 并上传产物
-        env:
-          TOKEN: ${{ secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
           API="$SITE/api/v1/repos/$REPO"
           AUTH="Authorization: token ${TOKEN}"
-          REQ=$(node -e 'const fs=require("fs");process.stdout.write(JSON.stringify({tag_name:process.env.GITEA_REF_NAME,name:"pn "+process.env.GITEA_REF_NAME,body:fs.readFileSync("release-notes.md","utf8")}))')
+          REQ=$(node -e 'const fs=require("fs");process.stdout.write(JSON.stringify({tag_name:process.env.TAG,name:"pn "+process.env.TAG,body:fs.readFileSync("release-notes.md","utf8")}))')
           # 同 tag release 已存在（如重跑）时回退为查询
           REL=$(curl -fsS -X POST "$API/releases" -H "$AUTH" -H 'Content-Type: application/json' -d "$REQ") \
-            || REL=$(curl -fsS "$API/releases/tags/${GITEA_REF_NAME}" -H "$AUTH")
+            || REL=$(curl -fsS "$API/releases/tags/${TAG}" -H "$AUTH")
           RID=$(node -e 'let s="";process.stdin.on("data",d=>s+=d);process.stdin.on("end",()=>process.stdout.write(String(JSON.parse(s).id))' <<<"$REL")
           echo "==> release id=$RID"
           for f in dist/*; do
             echo "==> 上传 $(basename "$f")"
             curl -fsS -X POST "$API/releases/$RID/assets?name=$(basename "$f")" -H "$AUTH" -F "attachment=@$f" >/dev/null
           done
-          echo "==> 完成：$SITE/$REPO/releases/tag/${GITEA_REF_NAME}"
+          echo "==> 完成：$SITE/$REPO/releases/tag/${TAG}"