diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index bb3761b70..5ef487606 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -17,6 +17,8 @@ jobs:
     steps:
     - name: Checkout code
       shell: sh
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
       run: |
         set -eu
         archive_url="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/archive/${GITHUB_SHA}.tar.gz"
@@ -85,6 +87,8 @@ jobs:
     steps:
     - name: Checkout code
       shell: sh
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
       run: |
         set -eu
         archive_url="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/archive/${GITHUB_SHA}.tar.gz"
diff --git a/docs/GITEA-RUNTIME-BUILDER-RUNNER.md b/docs/GITEA-RUNTIME-BUILDER-RUNNER.md
index 9fb70b52e..f4286925c 100644
--- a/docs/GITEA-RUNTIME-BUILDER-RUNNER.md
+++ b/docs/GITEA-RUNTIME-BUILDER-RUNNER.md
@@ -53,12 +53,13 @@ Do not store SSH private keys in the repository.
 On `v*` tag push:
 
 1. `build-production-runtime-images` runs on `runtime-builder`.
-2. It executes `scripts/build_release_images.sh <tag>`.
-3. It builds `apps/web/dist` in a Node Docker container, not on production.
-4. It packages `release-<tag>.tar.gz` with the prebuilt Web dist.
-5. It uploads both `runtime-images-<tag>.tar` and `release-<tag>.tar.gz` to production.
-6. `deploy-production` runs after the build job succeeds.
-7. `deploy-production` extracts the prebuilt release artifact, loads `/var/lib/xiaoxia-saas-production/runtime-images-<tag>.tar`, and restarts API/Worker/Web.
+2. Checkout downloads the repository archive using the explicit `${{ github.token }}` environment binding; runner shell environments must not assume `GITHUB_TOKEN` is implicitly set.
+3. It executes `scripts/build_release_images.sh <tag>`.
+4. It builds `apps/web/dist` in a Node Docker container, not on production.
+5. It packages `release-<tag>.tar.gz` with the prebuilt Web dist.
+6. It uploads both `runtime-images-<tag>.tar` and `release-<tag>.tar.gz` to production.
+7. `deploy-production` runs after the build job succeeds.
+8. `deploy-production` extracts the prebuilt release artifact, loads `/var/lib/xiaoxia-saas-production/runtime-images-<tag>.tar`, and restarts API/Worker/Web.
 
 If either the release tar or runtime image tar is missing, production deploy must fail.
 
diff --git a/tests/unit/test_release_scripts.py b/tests/unit/test_release_scripts.py
index 4c27fef06..54b5d0eec 100644
--- a/tests/unit/test_release_scripts.py
+++ b/tests/unit/test_release_scripts.py
@@ -14,6 +14,7 @@ def test_gitea_production_deploy_uses_production_ports():
     workflow = Path(".gitea/workflows/deploy.yml").read_text(encoding="utf-8")
     production_section = workflow.split("deploy-production:", 1)[1]
 
+    assert "GITHUB_TOKEN: ${{ github.token }}" in workflow
     assert "WEB_PORT=3001" not in production_section
     assert "http://127.0.0.1:8001/health" in production_section
     assert "RELEASE_VERSION=\"${GITHUB_REF_NAME}\"" in production_section
@@ -161,6 +162,7 @@ def test_gitea_production_deploy_requires_runtime_builder_job():
 
     assert "runs-on: runtime-builder" in build_section
     assert "scripts/build_release_images.sh \"${GITHUB_REF_NAME}\"" in build_section
+    assert "GITHUB_TOKEN: ${{ github.token }}" in build_section
     assert "docker.m.daocloud.io/library/node:20" in build_section
     assert "npm ci && npm run build" in build_section
     assert "dist/release-artifacts/xiaoxia-release-${GITHUB_REF_NAME}.tar.gz" in build_section