diff --git a/.gitea/workflows/server-deploy.yml b/.gitea/workflows/server-deploy.yml
index 5aedafa..ec726f9 100644
--- a/.gitea/workflows/server-deploy.yml
+++ b/.gitea/workflows/server-deploy.yml
@@ -118,13 +118,16 @@ jobs:
         env:
           GITEA_SHA: ${{ gitea.sha }}
           GITEA_RUN_NUMBER: ${{ gitea.run_number }}
+          LUNAR_PUBLISH_TOKEN: ${{ secrets.LUNAR_PUBLISH_TOKEN }}
         run: |
           set -e
           VERSION="1.0.${GITEA_RUN_NUMBER}"
           TAG="server-v${VERSION}"
           API="https://gitea.neatcn.com/api/v1/repos/gouki/lunar-mini"
-          # Gitea Actions 内建的 job 令牌（仓库写权限）
-          AUTH="Authorization: token ${GITEA_TOKEN}"
+          # 优先用仓库 Secret 令牌（GITEA_TOKEN 内建令牌在部分 runner 版本不注入）
+          TOKEN="${LUNAR_PUBLISH_TOKEN:-$GITEA_TOKEN}"
+          test -n "$TOKEN"
+          AUTH="Authorization: token $TOKEN"
 
           # 幂等：同 tag 已存在则先删除（重跑场景）；不依赖 python3，纯 grep/sed 解析
           EXISTING=$(curl -sS -H "$AUTH" "$API/releases/tags/$TAG" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2 || true)
@@ -132,10 +135,14 @@ jobs:
             curl -sS -X DELETE -H "$AUTH" "$API/releases/$EXISTING" -o /dev/null -w "删除旧 release: HTTP %{http_code}\n"
           fi
 
-          RELEASE_ID=$(curl -sS -X POST -H "$AUTH" -H "Content-Type: application/json" \
+          CREATE_RESP=$(curl -sS -X POST -H "$AUTH" -H "Content-Type: application/json" \
             -d "{\"tag_name\":\"$TAG\",\"name\":\"server $VERSION\",\"target_commitish\":\"main\",\"body\":\"CI 自动构建，commit ${GITEA_SHA:0:7}。doc79 由 deploy-watch.sh 拉取本附件完成部署。\"}" \
-            "$API/releases" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
-          test -n "$RELEASE_ID"
+            "$API/releases")
+          RELEASE_ID=$(printf '%s' "$CREATE_RESP" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2 || true)
+          if [ -z "$RELEASE_ID" ]; then
+            echo "创建 release 失败，API 响应: $CREATE_RESP"
+            exit 1
+          fi
           echo "Release created: id=$RELEASE_ID tag=$TAG"
 
           curl -sS -X POST -H "$AUTH" \