diff --git a/infra/docker/web.Dockerfile b/infra/docker/web.Dockerfile
index 6465e56fe..10cd2f15d 100755
--- a/infra/docker/web.Dockerfile
+++ b/infra/docker/web.Dockerfile
@@ -1,5 +1,6 @@
 # Build stage
 FROM git.xiaoxiajianji.com/xiaoxia/base/node:20 AS builder
+ARG SOURCE_HASH=""
 WORKDIR /app
 ARG VITE_API_URL=https://saas-api.xiaoxiajianji.com
 ENV VITE_API_URL=$VITE_API_URL
@@ -18,8 +19,10 @@ COPY apps/web/ ./
 
 # 构建：TS增量编译 + Vite构建，tsbuildinfo用cache mount持久化
 # node_modules直接使用镜像中已安装的（layer缓存保证完整性）
+# SOURCE_HASH 变化时强制重新执行（防止 buildkit 幽灵缓存命中）
 RUN --mount=type=cache,target=/app/apps/web/.tscache,sharing=locked \
     mkdir -p .tscache \
+    && echo "SOURCE_HASH=${SOURCE_HASH}" > .cache_bust \
     && ./node_modules/.bin/tsc --incremental --tsBuildInfoFile .tscache/tsconfig.tsbuildinfo \
     && ./node_modules/.bin/vite build
 
diff --git a/scripts/ci/docker_build_only.sh b/scripts/ci/docker_build_only.sh
index aed388ba9..20070b717 100755
--- a/scripts/ci/docker_build_only.sh
+++ b/scripts/ci/docker_build_only.sh
@@ -19,6 +19,18 @@ for arg in "$@"; do
   BUILD_ARGS="$BUILD_ARGS --build-arg $arg"
 done
 
+# Web 镜像 cache bust：计算 apps/web/ 的 git tree hash
+# 当源码变化时 hash 变化，buildx 的 ARG 缓存键失效 → vite build 必定重新执行
+if [ "${DOCKERFILE##*/}" = "web.Dockerfile" ]; then
+  SOURCE_HASH=$(git rev-parse HEAD:apps/web 2>/dev/null || echo "")
+  if [ -n "$SOURCE_HASH" ]; then
+    echo "Web cache bust: SOURCE_HASH=${SOURCE_HASH}"
+    BUILD_ARGS="$BUILD_ARGS --build-arg SOURCE_HASH=${SOURCE_HASH}"
+  else
+    echo "⚠️  无法计算 apps/web tree hash，跳过 cache bust"
+  fi
+fi
+
 BUILDER_NAME="ci-builder-persist"
 if ! docker buildx inspect "$BUILDER_NAME" > /dev/null 2>&1; then
   echo "持久 builder 不存在，创建中..."
diff --git a/scripts/ci/docker_build_push.sh b/scripts/ci/docker_build_push.sh
index 26fbc8bb5..0f0fc018e 100755
--- a/scripts/ci/docker_build_push.sh
+++ b/scripts/ci/docker_build_push.sh
@@ -31,6 +31,18 @@ for arg in "$@"; do
   BUILD_ARGS="$BUILD_ARGS --build-arg $arg"
 done
 
+# Web 镜像 cache bust：计算 apps/web/ 的 git tree hash
+# 当源码变化时 hash 变化，buildx 的 ARG 缓存键失效 → vite build 必定重新执行
+if [ "${DOCKERFILE##*/}" = "web.Dockerfile" ]; then
+  SOURCE_HASH=$(git rev-parse HEAD:apps/web 2>/dev/null || echo "")
+  if [ -n "$SOURCE_HASH" ]; then
+    echo "Web cache bust: SOURCE_HASH=${SOURCE_HASH}"
+    BUILD_ARGS="$BUILD_ARGS --build-arg SOURCE_HASH=${SOURCE_HASH}"
+  else
+    echo "⚠️  无法计算 apps/web tree hash，跳过 cache bust"
+  fi
+fi
+
 # 确保持久 builder 存在并使用（幂等）
 if ! docker buildx inspect "$BUILDER_NAME" > /dev/null 2>&1; then
   echo "持久 builder 不存在，创建中..."