diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index a0f64b9..8d181ea 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -15,6 +15,8 @@ env:
   DEPLOY_USER: root
   DEPLOY_DIR: /app/registry
   IMAGE_NAME: registry-app
+  # SSH 端口：可通过 secrets.SSH_PORT 覆盖，未配置时默认 22
+  SSH_PORT: ${{ secrets.SSH_PORT || '22' }}
 
 jobs:
   build-and-deploy:
@@ -73,19 +75,19 @@ jobs:
           cat ~/.ssh/deploy_key.pub
 
           echo "===== 诊断 4：known_hosts ====="
-          ssh-keyscan -H "${DEPLOY_HOST}" >> ~/.ssh/known_hosts 2>&1
+          ssh-keyscan -p "${SSH_PORT}" -H "${DEPLOY_HOST}" >> ~/.ssh/known_hosts 2>&1
           echo "known_hosts 行数: $(wc -l < ~/.ssh/known_hosts)"
 
       - name: 上传 start.sh 到部署目录
         run: |
           # 强制仅用密钥认证 + 详细日志，password 认证禁用后仍失败会直接抛错
           SSH_OPTS='-i ~/.ssh/deploy_key -o IdentitiesOnly=yes -o PreferredAuthentications=publickey -o BatchMode=yes'
-          ssh $SSH_OPTS "${DEPLOY_USER}@${DEPLOY_HOST}" "mkdir -p ${DEPLOY_DIR}"
-          scp $SSH_OPTS deploy/start.sh "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_DIR}/start.sh"
-          ssh $SSH_OPTS "${DEPLOY_USER}@${DEPLOY_HOST}" "chmod +x ${DEPLOY_DIR}/start.sh"
+          ssh -p "${SSH_PORT}" $SSH_OPTS "${DEPLOY_USER}@${DEPLOY_HOST}" "mkdir -p ${DEPLOY_DIR}"
+          scp -P "${SSH_PORT}" $SSH_OPTS deploy/start.sh "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_DIR}/start.sh"
+          ssh -p "${SSH_PORT}" $SSH_OPTS "${DEPLOY_USER}@${DEPLOY_HOST}" "chmod +x ${DEPLOY_DIR}/start.sh"
 
       - name: 远程执行部署
         run: |
           SSH_OPTS='-i ~/.ssh/deploy_key -o IdentitiesOnly=yes -o PreferredAuthentications=publickey -o BatchMode=yes'
-          ssh $SSH_OPTS "${DEPLOY_USER}@${DEPLOY_HOST}" \
+          ssh -p "${SSH_PORT}" $SSH_OPTS "${DEPLOY_USER}@${DEPLOY_HOST}" \
             "IMAGE_TAG=${{ steps.meta.outputs.tag }} ${DEPLOY_DIR}/start.sh"
\ No newline at end of file