diff --git a/.gitea/workflows/deploy-client.yml b/.gitea/workflows/deploy-client.yml
index 641d9b1..cfe5e32 100644
--- a/.gitea/workflows/deploy-client.yml
+++ b/.gitea/workflows/deploy-client.yml
@@ -40,6 +40,10 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          # 浅克隆:走 ali frps 隧道时数据量从全历史降到一层,大幅降低 Checkout 超时率
+          # (外网/在家都受益;根治外网稳定见 fetch 重试 + frps 调优)。
+          fetch-depth: 1
 
       - name: Compile (Android APK)
         env:
@@ -71,6 +75,10 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          # 浅克隆:走 ali frps 隧道时数据量从全历史降到一层,大幅降低 Checkout 超时率
+          # (外网/在家都受益;根治外网稳定见 fetch 重试 + frps 调优)。
+          fetch-depth: 1
 
       - name: Compile (Windows installer)
         shell: bash
@@ -113,6 +121,10 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          # 浅克隆:走 ali frps 隧道时数据量从全历史降到一层,大幅降低 Checkout 超时率
+          # (外网/在家都受益;根治外网稳定见 fetch 重试 + frps 调优)。
+          fetch-depth: 1
 
       # 多账号切换(见 docs/ci-multi-account-signing-design.html):从 signing.env
       # 单源读 SIGNING_ACCOUNT(us|cn),下方按它选账号的证书/ASC 密钥集。
@@ -158,6 +170,10 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          # 浅克隆:走 ali frps 隧道时数据量从全历史降到一层,大幅降低 Checkout 超时率
+          # (外网/在家都受益;根治外网稳定见 fetch 重试 + frps 调优)。
+          fetch-depth: 1
 
       - name: Resolve signing account
         id: acct
@@ -191,6 +207,10 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          # 浅克隆:走 ali frps 隧道时数据量从全历史降到一层,大幅降低 Checkout 超时率
+          # (外网/在家都受益;根治外网稳定见 fetch 重试 + frps 调优)。
+          fetch-depth: 1
       - name: Compile (Astro 官网)
         env:
           SITE_URL: https://pangolin.yanmeiai.com
@@ -226,6 +246,10 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          # 浅克隆:走 ali frps 隧道时数据量从全历史降到一层,大幅降低 Checkout 超时率
+          # (外网/在家都受益;根治外网稳定见 fetch 重试 + frps 调优)。
+          fetch-depth: 1
 
       # 一次性下所有 artifact(不带 name),避免同 job 内两次复用 download-artifact
       # action → act 对其只读缓存 git 仓库做二次操作时 EACCES(pack idx 444)。
diff --git a/scripts/build-libbox.sh b/scripts/build-libbox.sh
index 1803071..42e8dd6 100644
--- a/scripts/build-libbox.sh
+++ b/scripts/build-libbox.sh
@@ -57,7 +57,14 @@ rm -rf "$WORK/sing-box"
 # sing-box 源码:默认 github,CI 里国内 runner 连不上 github → 经 SINGBOX_GIT 指向
 # NAS gitea 镜像(wangjia/sing-box,gitea migrate 自 github)。见 deploy-client.yml。
 SINGBOX_GIT="${SINGBOX_GIT:-https://github.com/SagerNet/sing-box.git}"
-git clone --depth 1 --branch "$SINGBOX_VERSION" "$SINGBOX_GIT" "$WORK/sing-box"
+# 已是 --depth 1 浅克隆;外网 runner 经 ali frps 隧道 clone 偶发超时 → 重试 3 次。
+_sb_ok=
+for _try in 1 2 3; do
+  rm -rf "$WORK/sing-box"
+  if git clone --depth 1 --branch "$SINGBOX_VERSION" "$SINGBOX_GIT" "$WORK/sing-box"; then _sb_ok=1; break; fi
+  echo "   sing-box clone 第 $_try 次失败(frps 抖动?),12s 后重试..."; sleep 12
+done
+[ -n "$_sb_ok" ] || { echo "✗ sing-box clone 重试耗尽($SINGBOX_GIT)"; exit 1; }
 cd "$WORK/sing-box"
 
 echo "==> [3/3] 用官方 build_libbox 编核心库"