diff --git a/.gitea/workflows/docker-build.yml b/.gitea/workflows/docker-build.yml
index 363c1a4..e3cfdcb 100644
--- a/.gitea/workflows/docker-build.yml
+++ b/.gitea/workflows/docker-build.yml
@@ -43,6 +43,8 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y minisign
 
       - name: Fetch config center (minisign key)
+        # 私钥直接写文件 (build-ota.mjs 默认 KEY_PATH 即 ota-package/hotswap.key),
+        # 绕开 GITHUB_ENV 多行值在 Gitea Actions 下不可靠的问题
         run: |
           set -euo pipefail
           export CONFIG_CENTER_URL="${CONFIG_CENTER_URL:-$REGISTRY_URL_FALLBACK}"
@@ -55,19 +57,15 @@ jobs:
               req.add_header("Authorization", "Bearer " + token)
           with urllib.request.urlopen(req, timeout=20) as r:
               data = json.load(r).get("data", [])
-          wanted = {}
-          for cfg in data:
-              if cfg.get("key") == "MINISIGN_PRIVATE_KEY":
-                  wanted[cfg["key"]] = cfg.get("value", "")
-          with open(os.environ["GITHUB_ENV"], "a", encoding="utf-8") as f:
-              for k, v in wanted.items():
-                  if "\n" in v or v.startswith("untrusted comment"):
-                      f.write(f"{k}<<EOF\n{v}\nEOF\n")
-                  else:
-                      f.write(f"{k}={v}\n")
-          if "MINISIGN_PRIVATE_KEY" not in wanted:
+          key_val = next((c.get("value", "") for c in data if c.get("key") == "MINISIGN_PRIVATE_KEY"), None)
+          if not key_val:
               raise SystemExit("配置中心缺少 MINISIGN_PRIVATE_KEY (service-wardrobe/ota)")
+          os.makedirs("ota-package", exist_ok=True)
+          with open("ota-package/hotswap.key", "w", encoding="utf-8") as f:
+              f.write(key_val if key_val.endswith("\n") else key_val + "\n")
+          os.chmod("ota-package/hotswap.key", 0o600)
           PYEOF
+          echo "hotswap.key lines=$(wc -l < ota-package/hotswap.key)"
 
       - name: Build & sign OTA package
         # 每次主分支提交生成 OTA 升级包, sequence 默认时间戳 (单调递增)
@@ -76,7 +74,8 @@ jobs:
           OTA_NOTES: ${{ github.sha }}
         run: |
           set -euo pipefail
-          node scripts/build-ota.mjs --out ota-package --notes ${OTA_NOTES}
+          # --key 显式指定 (默认路径相同); 私钥已由上一步写入该文件
+          node scripts/build-ota.mjs --out ota-package --key ota-package/hotswap.key --notes ${OTA_NOTES}
           echo "===== latest.json ====="
           cat ota-package/latest.json
           echo "===== bundle sha256 ====="
diff --git a/.gitea/workflows/ota-build.yml b/.gitea/workflows/ota-build.yml
index ef327c9..960567a 100644
--- a/.gitea/workflows/ota-build.yml
+++ b/.gitea/workflows/ota-build.yml
@@ -63,14 +63,15 @@ jobs:
           url = os.environ["CONFIG_CENTER_URL"]
           token = os.environ.get("CONFIG_CENTER_TOKEN", "") or ""
           wanted = {}
+          minisign_key = None
           req = urllib.request.Request(f"{url}/api/projects/{os.environ['CFG_PROJECT_SIGNING']}/configs")
           if token:
               req.add_header("Authorization", "Bearer " + token)
           with urllib.request.urlopen(req, timeout=20) as r:
               data = json.load(r).get("data", [])
           for cfg in data:
-              if cfg.get("key") in ("MINISIGN_PRIVATE_KEY",):
-                  wanted[cfg["key"]] = cfg.get("value", "")
+              if cfg.get("key") == "MINISIGN_PRIVATE_KEY":
+                  minisign_key = cfg.get("value", "")
           req = urllib.request.Request(f"{url}/api/projects/{os.environ['CFG_PROJECT_R2']}/configs")
           if token:
               req.add_header("Authorization", "Bearer " + token)
@@ -79,26 +80,29 @@ jobs:
           for cfg in data:
               if cfg.get("key") in ("CF_API_TOKEN", "CF_R2_PUBLIC_URL"):
                   wanted[cfg["key"]] = cfg.get("value", "")
-          # GITHUB_ENV 多行值需用 heredoc 语法; 单行值直接 NAME=value
+          # 私钥直接写文件 (绕开 GITHUB_ENV 多行值问题); R2 单行值仍走 GITHUB_ENV
+          if not minisign_key:
+              raise SystemExit("配置中心缺少 MINISIGN_PRIVATE_KEY (service-wardrobe/ota)")
+          os.makedirs("ota-package", exist_ok=True)
+          with open("ota-package/hotswap.key", "w", encoding="utf-8") as f:
+              f.write(minisign_key if minisign_key.endswith("\n") else minisign_key + "\n")
+          os.chmod("ota-package/hotswap.key", 0o600)
           with open(os.environ["GITHUB_ENV"], "a", encoding="utf-8") as f:
               for k, v in wanted.items():
-                  if "\n" in v or v.startswith("untrusted comment"):
-                      f.write(f"{k}<<EOF\n{v}\nEOF\n")
-                  else:
-                      f.write(f"{k}={v}\n")
-          missing = [k for k in ("MINISIGN_PRIVATE_KEY", "CF_API_TOKEN") if k not in wanted]
+                  f.write(f"{k}={v}\n")
+          missing = [k for k in ("CF_API_TOKEN", "CF_R2_PUBLIC_URL") if k not in wanted]
           if missing:
               raise SystemExit("配置中心缺少: " + ", ".join(missing))
           PYEOF
+          echo "hotswap.key lines=$(wc -l < ota-package/hotswap.key)"
 
       - name: Build & sign OTA package
-        # MINISIGN_PRIVATE_KEY 由上一步写入 GITHUB_ENV, 已是本步的真实环境变量,
-        # build-ota.mjs 直接读 process.env.MINISIGN_PRIVATE_KEY, 无需再映射
+        # 私钥已由上一步写入 ota-package/hotswap.key, --key 显式指定
         env:
           OTA_NOTES: ${{ inputs.notes }}
         run: |
           set -euo pipefail
-          ARGS="--out ota-package"
+          ARGS="--out ota-package --key ota-package/hotswap.key"
           if [ -n "${{ inputs.sequence }}" ]; then ARGS="${ARGS} --sequence ${{ inputs.sequence }}"; fi
           if [ -n "${OTA_NOTES}" ]; then ARGS="${ARGS} --notes ${OTA_NOTES}"; fi
           node scripts/build-ota.mjs ${ARGS}