diff --git a/.gitea/workflows/deploy-server.yml b/.gitea/workflows/deploy-server.yml
index f2bc9d6..570e13a 100644
--- a/.gitea/workflows/deploy-server.yml
+++ b/.gitea/workflows/deploy-server.yml
@@ -37,6 +37,21 @@ jobs:
           export PATH=/usr/local/go/bin:$PATH
           go version
 
+      # go.mod 依赖 github.com/wangjia/codes 的真源是自建私有 gitea(GOPROXY=goproxy.cn
+      # 对私有仓返 404 → 回退 direct git 到 github.com → 无凭证 terminal-prompts-disabled
+      # 失败)。这里把 go 对该路径的拉取重写到 gitea 并注入 token(oauth2:<token>
+      # basic-auth),GOPRIVATE 让 go 跳过公共 proxy/sumdb 直接走 git。runner 模块缓存
+      # 为热时不触发此路径,冷缓存(如换 runner/清缓存)必需。
+      - name: 私有依赖鉴权(github.com/wangjia/codes → 自建 gitea)
+        env:
+          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+          FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
+        run: |
+          proto="${FORGEJO_URL%%://*}"
+          host="${FORGEJO_URL#*://}"
+          git config --global url."${proto}://oauth2:${FORGEJO_TOKEN}@${host}/wangjia/codes.git".insteadOf "https://github.com/wangjia/codes"
+          echo "GOPRIVATE=github.com/wangjia/codes" >> "$GITHUB_ENV"
+
       # 直接在 runner 跑(不嵌套 docker,避免 DinD 挂载失败;go 由上一步装好)。
       - name: Compile (Go 控制面)
         run: bash scripts/ci/compile-backend.sh