diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index b7ea51473..4719cbad5 100755
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -24,7 +24,7 @@ concurrency:
 jobs:
   check-frontend-only:
     name: Check if frontend-only change
-    runs-on: ci-l1
+    runs-on: ci-check
     if: github.event_name == 'pull_request'
     outputs:
       skip_backend: ${{ steps.check.outputs.skip_backend }}
@@ -60,7 +60,7 @@ jobs:
     needs: check-frontend-only
     if: always() && needs.check-frontend-only.outputs.skip_backend != 'true'
     name: Validate Code Quality And Tests
-    runs-on: ci-l1
+    runs-on: ci-check
     timeout-minutes: 10
     env:
       DATABASE_URL: postgresql+psycopg://postgres:postgres@127.0.0.1:5432/xiaoxia_saas
@@ -264,7 +264,59 @@ jobs:
         '
     - name: Run unit tests with coverage
       shell: sh
-      run: "set -eu\nPYTHONPATH=\"$PWD/apps/api:$PWD\" python3 -m coverage run \\\n  --source=apps/api/app,packages \\\n  --omit=\"*/migrations/*,*/tests/*,*/test_*.py,*/site-packages/*\" \\\n  --branch \\\n  -m pytest tests/unit -q\npython3 -m coverage report --show-missing\npython3 -m coverage xml -o coverage.xml\npython3 -m coverage report --fail-under=60 > /dev/null\n"
+      run: "set -eu\nPYTHONPATH=\"$PWD/apps/api:$PWD\" python3 -m coverage run \\\n  --source=apps/api/app,packages \\\n  --omit=\"*/migrations/*,*/tests/*,*/test_*.py,*/site-packages/*\" \\\n  --branch \\\n  -m pytest tests/unit -q\npython3 -m coverage report --show-missing\npython3 -m coverage xml -o coverage.xml\npython3 -m coverage report --fail-under=65 > /dev/null\n"
+    - name: Diff coverage check (增量行覆盖率)
+      if: github.event_name == 'pull_request'
+      shell: sh
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        set -eu
+        PR_NUMBER=$(echo "$GITHUB_REF" | sed 's|refs/pull/||; s|/.*||')
+        
+        # 获取base分支
+        BASE_BRANCH="${{ github.base_ref }}"
+        echo "Base branch: $BASE_BRANCH"
+        
+        # 初始化git (CI tarball checkout没有.git目录)
+        git init > /dev/null 2>&1
+        git remote add origin https://git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas.git > /dev/null 2>&1
+        git config user.email "ci@local"
+        git config user.name "CI"
+        # 拉取base分支用于对比
+        git fetch origin $BASE_BRANCH --depth=100
+        # 提交当前代码
+        git add -A > /dev/null 2>&1
+        git commit -m "ci-tmp" > /dev/null 2>&1
+        
+        # 根据模式设置门槛
+        if [ "${UNIT_TEST_MODE:-full}" = "incremental" ]; then
+          # 增量测试模式覆盖不全，门槛设低一些
+          THRESHOLD=40
+          echo "增量测试模式，增量覆盖率门槛: ${THRESHOLD}%"
+        else
+          THRESHOLD=60
+          echo "全量测试模式，增量覆盖率门槛: ${THRESHOLD}%"
+        fi
+        
+        # 运行diff-cover
+        set +e
+        python3 -m diff_cover.diff_cover_tool coverage.xml           --compare-branch="origin/$BASE_BRANCH"           --fail-under=$THRESHOLD           --html-report diff_coverage.html           2>&1
+        DIFF_EXIT=$?
+        set -e
+        
+        if [ $DIFF_EXIT -ne 0 ]; then
+          echo ""
+          echo "❌ 增量覆盖率未达到门槛 (${THRESHOLD}%)"
+          echo "   请为改动的代码添加单元测试后再提交"
+          echo ""
+          echo "=== 覆盖率报告 ==="
+          python3 -m diff_cover.diff_cover_tool coverage.xml             --compare-branch="origin/$BASE_BRANCH" 2>&1 | tail -30
+          exit 1
+        fi
+        
+        echo "✅ 增量覆盖率达标"
+
     - name: CI failure notification
       if: failure()
       shell: sh
@@ -412,7 +464,7 @@ jobs:
         '
   frontend-lint:
     name: Frontend Lint
-    runs-on: ci-l1
+    runs-on: ci-check
     timeout-minutes: 10
     steps:
     - name: Checkout code
diff --git a/requirements-dev.txt b/requirements-dev.txt
index 585f62d07..e0959a8cc 100755
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -11,3 +11,4 @@ pytest==8.3.3
 pytest-asyncio==0.24.0
 pytest-cov==6.0.0
 pytest-timeout==2.3.1
+diff-cover>=8.0