diff --git a/scripts/ci/lib-ssh.sh b/scripts/ci/lib-ssh.sh
index fc7cb9f..86d1ea8 100755
--- a/scripts/ci/lib-ssh.sh
+++ b/scripts/ci/lib-ssh.sh
@@ -56,8 +56,12 @@ setup_ssh() {
   # abort the deploy.
   ssh-keyscan -p "${DEPLOY_PORT}" -H "${DEPLOY_HOST}" >> "${SSH_KNOWN_HOSTS_FILE}" 2>/dev/null || true
 
-  SSH="ssh -i ${SSH_KEY_FILE} -p ${DEPLOY_PORT} -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=${SSH_KNOWN_HOSTS_FILE}"
-  RSYNC_SSH="ssh -i ${SSH_KEY_FILE} -p ${DEPLOY_PORT} -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=${SSH_KNOWN_HOSTS_FILE}"
+  # IdentitiesOnly=yes:只用上面 -i 指定的 key,不把 agent/默认 key 也递上去
+  #   (否则会触发服务器 MaxAuthTries「Too many authentication failures」)。
+  # BatchMode=yes:纯非交互,认证失败即退出,不回落到密码提示卡住。
+  _ssh_opts="-i ${SSH_KEY_FILE} -p ${DEPLOY_PORT} -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=${SSH_KNOWN_HOSTS_FILE}"
+  SSH="ssh ${_ssh_opts}"
+  RSYNC_SSH="ssh ${_ssh_opts}"
   export SSH RSYNC_SSH SSH_KEY_FILE SSH_KNOWN_HOSTS_FILE DEPLOY_HOST DEPLOY_PORT
   echo "==> setup_ssh: key written to ${SSH_KEY_FILE}, known_hosts pinned (accept-new) for ${DEPLOY_HOST}:${DEPLOY_PORT}"
 }