diff --git a/.gitea/workflows/ci-pipeline.yml b/.gitea/workflows/ci-pipeline.yml
index 6d20a27c7..556f74911 100755
--- a/.gitea/workflows/ci-pipeline.yml
+++ b/.gitea/workflows/ci-pipeline.yml
@@ -908,7 +908,7 @@ jobs:
     runs-on: runtime-builder
     timeout-minutes: 10
     needs:
-    - build-staging
+    - deploy-staging
     if: github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'develop')
     env:
       ACR_REGISTRY: xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com
@@ -928,6 +928,7 @@ jobs:
       env:
         ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
         ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+        PROTECTED_TAG: ${{ github.sha }}
       run: |
         set -eu
         python3 scripts/ci/acr_cleanup.py \
diff --git a/scripts/ci/acr_cleanup.py b/scripts/ci/acr_cleanup.py
index 3986e2d61..a705f618e 100644
--- a/scripts/ci/acr_cleanup.py
+++ b/scripts/ci/acr_cleanup.py
@@ -278,6 +278,15 @@ def cleanup_repo(repo, keep_count, pr_days, dry_run):
         valid_kept = [t for t in kept if t["created"]]
         if valid_kept:
             print("  最早保留:", valid_kept[-1]["tag"][:12], "(" + valid_kept[-1]["created"][:10] + ")")
+        # 保护当前构建的tag（通过PROTECTED_TAG环境变量传入，如GITHUB_SHA）
+        protected_tag = os.environ.get("PROTECTED_TAG", "").strip()
+        if protected_tag:
+            before = len(to_delete)
+            to_delete = [t for t in to_delete if not t["tag"].startswith(protected_tag)]
+            removed = before - len(to_delete)
+            if removed > 0:
+                print(f"  保护当前构建tag: {protected_tag[:12]} (跳过{removed}个)")
+
         to_del_valid = [t for t in to_delete if t["digest"]]
         print("  可删除(有digest):", len(to_del_valid), "个")
     else: