diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index d7c8a149..d9bd5d53 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -387,6 +387,9 @@ jobs:
             # 用 token 推送（避免 SSH key 需要額外設定 push 權限）
             git remote remove gitea 2>/dev/null || true
             git remote add gitea http://wooo:${GITEA_TOKEN}@192.168.0.110:3001/wooo/awoooi.git
+            # 先 rebase 避免 non-fast-forward (其他 commit 在 CI 期間已推入)
+            git fetch gitea main
+            git rebase gitea/main
             git push gitea main
             echo "✅ kustomization.yaml 已 push，等待 ArgoCD sync..."
           }
diff --git a/k8s/awoooi-prod/kustomization.yaml b/k8s/awoooi-prod/kustomization.yaml
index be8ab2ac..e135dd02 100644
--- a/k8s/awoooi-prod/kustomization.yaml
+++ b/k8s/awoooi-prod/kustomization.yaml
@@ -38,7 +38,7 @@ resources:
 images:
 - name: 192.168.0.110:5000/library/api:IMAGE_TAG_PLACEHOLDER
   newName: 192.168.0.110:5000/awoooi/api
-  newTag: c439277fc3ddec4ce207e9ce3b82dbac87f7da6e
+  newTag: 8be87b0f32a7430d86e93b9be63677c0e498bb79
 - name: 192.168.0.110:5000/library/web:IMAGE_TAG_PLACEHOLDER
   newName: 192.168.0.110:5000/awoooi/web
-  newTag: c439277fc3ddec4ce207e9ce3b82dbac87f7da6e
+  newTag: 8be87b0f32a7430d86e93b9be63677c0e498bb79