diff --git a/scripts/ci/lib-forgejo.sh b/scripts/ci/lib-forgejo.sh
index ab09a7c..6d82338 100644
--- a/scripts/ci/lib-forgejo.sh
+++ b/scripts/ci/lib-forgejo.sh
@@ -114,7 +114,11 @@ setup_ssh() {
   local host="${DEPLOY_HOST:-$EC2_HOST}"
   local key="${DEPLOY_SSH_KEY:-$EC2_SSH_KEY}"
   mkdir -p ~/.ssh
-  printf '%s' "${key}" > ~/.ssh/ec2_deploy.pem
+  # `printf '%s\n'` 末尾补一个换行：Forgejo 存 secret 会去掉结尾换行，而
+  # OpenSSH 格式私钥（-----BEGIN OPENSSH PRIVATE KEY-----，如阿里 ed25519 部署 key）
+  # 缺结尾换行会被判为 "invalid format" 而拒绝加载，退化成无密钥 → Permission denied。
+  # 多补的换行对已含结尾换行的 PEM（如 EC2 key）无害。
+  printf '%s\n' "${key}" > ~/.ssh/ec2_deploy.pem
   chmod 600 ~/.ssh/ec2_deploy.pem
   ssh-keyscan -H "${host}" >> ~/.ssh/known_hosts 2>/dev/null
   SSH="ssh -i ~/.ssh/ec2_deploy.pem -o StrictHostKeyChecking=no"