diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 0220206..9fbf63f 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -26,16 +26,17 @@ jobs:
         uses: actions/checkout@v4
 
       - name: shellcheck 节点脚本(bootstrap + single-node)
+        # 注:koalaman/shellcheck 镜像 ENTRYPOINT 已是 shellcheck,命令里别再写一遍
+        # (否则变 `shellcheck shellcheck …`,把 "shellcheck" 当文件→openBinaryFile 报错)。
         run: |
-          echo "== checkout 内容诊断 =="; pwd; ls -la; echo "-- deploy --"; ls -la deploy 2>&1 | head || echo "NO DEPLOY DIR"
           docker run --rm \
-            -v "$PWD:/repo:ro" \
+            -v "$PWD/deploy:/mnt/deploy:ro" \
             koalaman/shellcheck:stable \
-            shellcheck -S warning \
-              /repo/deploy/bootstrap/init.sh \
-              /repo/deploy/bootstrap/monitor/pangolin-monitor.sh \
-              /repo/deploy/bootstrap/monitor/deadman-watch.sh \
-              /repo/deploy/single-node/deploy.sh
+            -S warning \
+              /mnt/deploy/bootstrap/init.sh \
+              /mnt/deploy/bootstrap/monitor/pangolin-monitor.sh \
+              /mnt/deploy/bootstrap/monitor/deadman-watch.sh \
+              /mnt/deploy/single-node/deploy.sh
 
   # ── Job 2: OpenAPI Sync Check ────────────────────────────────────────────
   openapi-check: