diff --git a/k8s/awoooi-prod/06-deployment-api.yaml b/k8s/awoooi-prod/06-deployment-api.yaml
index 581fd52b..017d2bfb 100644
--- a/k8s/awoooi-prod/06-deployment-api.yaml
+++ b/k8s/awoooi-prod/06-deployment-api.yaml
@@ -109,9 +109,11 @@ spec:
             secretName: awoooi-repair-ssh-key
             defaultMode: 0400  # 八進位 0400 = 十進位 256 = r-------- (owner read-only)
         # 2026-04-06 Claude Code: Sprint 3 Security Fix A1
+        # optional: true — CD 首次跑時建立 secret，Pod 不阻塞等待
         - name: repair-known-hosts
           secret:
             secretName: awoooi-repair-known-hosts
+            optional: true
 
 ---
 apiVersion: v1