diff --git a/scripts/ci/_env.sh b/scripts/ci/_env.sh
index c732293..483975a 100755
--- a/scripts/ci/_env.sh
+++ b/scripts/ci/_env.sh
@@ -6,6 +6,9 @@
 export GOPROXY="${GOPROXY:-https://goproxy.cn,direct}"
 export PUB_HOSTED_URL="${PUB_HOSTED_URL:-https://pub.flutter-io.cn}"
 export FLUTTER_STORAGE_BASE_URL="${FLUTTER_STORAGE_BASE_URL:-https://storage.flutter-io.cn}"
+# npm/npx 国内镜像:site 流水线(Astro 官网 + Next.js 用户中心 + npx wrangler)在
+# 墙内 nas runner 上直连 registry.npmjs.org 会慢/抖断,与 Go/Flutter 同样需镜像。
+export NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY:-https://registry.npmmirror.com}"
 
 # Forgejo/Gitea repo coordinates (used by lib-forgejo.sh). Secrets
 # FORGEJO_TOKEN / FORGEJO_URL are injected by the CI runner, not set here.
@@ -44,3 +47,16 @@ flutter_pub_get_retry() {
   echo "==> flutter pub get 5 次仍失败,放弃" >&2
   return 1
 }
+
+# npm_ci_retry — 同理:npmmirror 偶发抖断时重试 `npm ci`。在含 package-lock.json 的
+# 目录调用(site 各 web 子项目根)。已由 NPM_CONFIG_REGISTRY 指向国内镜像。
+npm_ci_retry() {
+  local i
+  for i in 1 2 3 4 5; do
+    if npm ci; then return 0; fi
+    echo "==> npm ci 失败(第 ${i}/5 次,registry 抖?),8s 后重试..." >&2
+    sleep 8
+  done
+  echo "==> npm ci 5 次仍失败,放弃" >&2
+  return 1
+}
diff --git a/scripts/ci/compile-site.sh b/scripts/ci/compile-site.sh
index 8ab204e..8005c3a 100755
--- a/scripts/ci/compile-site.sh
+++ b/scripts/ci/compile-site.sh
@@ -4,16 +4,19 @@
 # web/website/astro.config.mjs) — must match the deploy target host name so
 # canonical URLs / sitemap resolve correctly.
 #
-# Run inside a node:20 container by .gitea/workflows/deploy-site.yml; this
-# script itself just runs npm and assumes it is invoked from the repo root.
+# 由 .gitea/workflows/deploy-site.yml 在 ubuntu runner 上从 repo 根调用(runner
+# 镜像自带 node/npx,直接跑)。source _env.sh 取 npm 国内镜像 + 重试助手(墙内)。
 set -euo pipefail
 
+# shellcheck source=scripts/ci/_env.sh
+. scripts/ci/_env.sh
+
 SITE_URL="${SITE_URL:-https://pangolin.yanmeiai.com}"
 export SITE_URL
-echo "==> compile-site: SITE_URL=${SITE_URL}"
+echo "==> compile-site: SITE_URL=${SITE_URL} NPM_CONFIG_REGISTRY=${NPM_CONFIG_REGISTRY}"
 
 cd web/website
-npm ci
+npm_ci_retry
 npm run build
 
 echo "==> compile-site: done — dist/ contents:"
diff --git a/scripts/ci/compile-usercenter.sh b/scripts/ci/compile-usercenter.sh
index 4d4c7c7..2fe9d85 100755
--- a/scripts/ci/compile-usercenter.sh
+++ b/scripts/ci/compile-usercenter.sh
@@ -11,12 +11,15 @@
 # 由 .gitea/workflows/deploy-site.yml 在 ubuntu runner 上调用,从 repo 根运行。
 set -euo pipefail
 
+# shellcheck source=scripts/ci/_env.sh
+. scripts/ci/_env.sh
+
 export NEXT_PUBLIC_API_MODE="${NEXT_PUBLIC_API_MODE:-http}"
 export NEXT_PUBLIC_API_DOMAINS="${NEXT_PUBLIC_API_DOMAINS:-https://api.yanmeiai.com}"
-echo "==> compile-usercenter: API_MODE=${NEXT_PUBLIC_API_MODE} API_DOMAINS=${NEXT_PUBLIC_API_DOMAINS}"
+echo "==> compile-usercenter: API_MODE=${NEXT_PUBLIC_API_MODE} API_DOMAINS=${NEXT_PUBLIC_API_DOMAINS} NPM_CONFIG_REGISTRY=${NPM_CONFIG_REGISTRY}"
 
 cd web/usercenter
-npm ci
+npm_ci_retry
 npm run build
 
 echo "==> compile-usercenter: done — out/ contents:"
diff --git a/scripts/ci/deploy-site.sh b/scripts/ci/deploy-site.sh
index e4914c0..416d0c4 100755
--- a/scripts/ci/deploy-site.sh
+++ b/scripts/ci/deploy-site.sh
@@ -10,6 +10,9 @@
 # 由 compile-site.sh 先产出 web/website/dist/;从 repo 根调用。
 set -euo pipefail
 
+# shellcheck source=scripts/ci/_env.sh
+. scripts/ci/_env.sh  # NPM_CONFIG_REGISTRY:让 `npx wrangler@4` 从国内镜像拉包
+
 if [ ! -d web/website/dist ]; then
   echo "==> deploy-site: web/website/dist/ 不存在 — 拒绝部署" >&2
   exit 1