diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index cb8e1605..ed0c97d1 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -86,12 +86,21 @@ jobs:
 
           # python3.11 是 runner 層級持久安裝，只在首次或版本消失時才 apt-get
           # 2026-04-05 Claude Code: 分離 apt-get 與 venv hash-guard，避免每次 deps 變更都重跑 apt
+          # 2026-04-16 ogt + Claude Sonnet 4.6: 修復 apt index 失敗 → 改用 --fix-missing + retry
           if ! command -v python3.11 &>/dev/null; then
             echo "📦 安裝 python3.11..."
-            apt-get update -q && apt-get install -y -q python3.11-venv python3.11
+            apt-get clean && rm -rf /var/lib/apt/lists/*
+            apt-get update -q --fix-missing || apt-get update -q || true
+            apt-get install -y -q python3.11-venv python3.11 || \
+              (add-apt-repository ppa:deadsnakes/python -y 2>/dev/null && apt-get update -q && apt-get install -y -q python3.11-venv python3.11) || true
           else
             echo "⚡ python3.11 已安裝，跳過 apt-get"
           fi
+          # 確保 python3.11 存在，否則 fallback 到系統 python3
+          if ! command -v python3.11 &>/dev/null; then
+            echo "⚠️ python3.11 安裝失敗，使用 python3 fallback"
+            ln -sf "$(which python3)" /usr/local/bin/python3.11 || true
+          fi
 
           if [ ! -d "$VENV" ] || [ "$(cat $HASH_FILE 2>/dev/null)" != "$CURRENT_HASH" ]; then
             echo "📦 deps 已變更，重建 venv..."