diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index 1c78d916b..d6a350642 100644
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -637,10 +637,26 @@ jobs:
     - name: Tag and push :staging images (Watchtower auto-update)
       shell: sh
       run: "set -eu\nREGISTRY=\"git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas\"\n\nfor svc in api worker web; do\n  echo \"Pulling ${REGISTRY}/xiaoxia-saas-${svc}:${GITHUB_SHA} ...\"\n  docker pull \"${REGISTRY}/xiaoxia-saas-${svc}:${GITHUB_SHA}\"\n  docker tag \"${REGISTRY}/xiaoxia-saas-${svc}:${GITHUB_SHA}\" \"${REGISTRY}/xiaoxia-saas-${svc}:staging\"\n  docker push \"${REGISTRY}/xiaoxia-saas-${svc}:staging\"\n  echo \"$svc :staging tagged and pushed\"\ndone\necho \"All :staging images pushed. Watchtower will auto-deploy within 60s.\"\n"
-    - name: Wait for Watchtower update + smoke test
+    - name: Staging health check + auto rollback
+      if: success()
       shell: sh
-      run: "set -eu\necho \"Waiting 90s for Watchtower to detect new image and restart containers...\"\nsleep 90\n\necho \"--- Smoke test 1: Health check ---\"\nfor i in $(seq 1 12); do\n  HEALTH=$(curl -sf --max-time 10 https://staging-api.xiaoxiajianji.com/health) && break\n  echo \"  Attempt $i/12: not ready yet, waiting 5s...\"\n  sleep 5\ndone\nif [ -z \"$HEALTH\" ]; then\n  echo \"FAIL: health endpoint unreachable after 60s\"\n  exit 1\nfi\necho \"Health OK: $HEALTH\"\n\necho \"--- Smoke test 2: Login API (expect 401) ---\"\nHTTP_CODE=$(curl -s -o /dev/null -w \"%{http_code}\" --max-time 10 -X POST \\\n  https://staging-api.xiaoxiajianji.com/api/v1/auth/login \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"email\":\"smoke@test.com\",\"password\":\"wrong\"}')\nif [ \"$HTTP_CODE\" != \"401\" ] && [ \"$HTTP_CODE\" != \"422\" ]; then\n  echo \"FAIL: login returned HTTP $HTTP_CODE (expected 401 or 422)\"\n  exit 1\nfi\necho \"Login API OK: HTTP $HTTP_CODE\"\n\necho \"--- Smoke\
-        \ test 3: API docs endpoint ---\"\nHTTP_CODE=$(curl -s -o /dev/null -w \"%{http_code}\" --max-time 10 https://staging-api.xiaoxiajianji.com/docs)\nif [ \"$HTTP_CODE\" != \"200\" ]; then\n  echo \"FAIL: /docs returned HTTP $HTTP_CODE (expected 200)\"\n  exit 1\nfi\necho \"Docs endpoint OK: HTTP $HTTP_CODE\"\n\necho \"--- Smoke test 4: Web frontend ---\"\nHTTP_CODE=$(curl -s -o /dev/null -w \"%{http_code}\" --max-time 10 https://staging.xiaoxiajianji.com/)\nif [ \"$HTTP_CODE\" != \"200\" ]; then\n  echo \"FAIL: web frontend returned HTTP $HTTP_CODE (expected 200)\"\n  exit 1\nfi\necho \"Web frontend OK: HTTP $HTTP_CODE\"\n\necho \"\"\necho \"=== All smoke tests passed! ===\"\necho \"Branch: ${GITHUB_REF_NAME}\"\necho \"Commit: ${GITHUB_SHA}\"\n"
+      env:
+        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
+        REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+      run: 'set -eu
+
+        echo "=========================================="
+
+        echo "  Staging 健康检查（Watchtower 模式）"
+
+        echo "=========================================="
+
+        echo ""
+
+
+        bash scripts/ci_staging_healthcheck.sh
+
+        '
     - name: Job duration summary
       if: always()
       shell: sh
@@ -1106,4 +1122,3 @@ jobs:
         NOTIFY_MODE=failure JOB_NAME="Production Browser E2E" python3 scripts/ci_notify.py
 
         '
-