diff --git a/.gitea/workflows/release-image.yml b/.gitea/workflows/release-image.yml
index b346e42..68fee71 100644
--- a/.gitea/workflows/release-image.yml
+++ b/.gitea/workflows/release-image.yml
@@ -44,24 +44,33 @@ jobs:
     name: 多架构构建并推送 ACR
     needs: test
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    # dind 自带独立 daemon：不依赖 runner 宿主机 docker.sock 转发配置
+    container:
+      image: docker:27-dind
+      options: --privileged
+    env:
+      DOCKER_HOST: unix:///var/run/docker.sock
+      DOCKER_TLS_CERTDIR: ""
+    timeout-minutes: 120
     steps:
-      - name: 安装工具并检出
+      - name: 启动 dind daemon 并检出
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories
-          apk add --no-cache git curl bash >/dev/null
+          apk add --no-cache git bash >/dev/null
+          dockerd --host=unix:///var/run/docker.sock >/tmp/dockerd.log 2>&1 &
+          for i in $(seq 1 30); do docker info >/dev/null 2>&1 && break; sleep 1; done
+          docker info --format 'dind 就绪: {{.ServerVersion}}'
           SCHEME="${GITHUB_SERVER_URL%%://*}"
           SRV="${GITHUB_SERVER_URL#*://}"
-          echo "clone from ${SCHEME}://${SRV}"
           git clone --depth=1 --branch "$GITHUB_REF_NAME" \
             "${SCHEME}://oauth2:${GITHUB_TOKEN}@${SRV}/${GITHUB_REPOSITORY}.git" .
-          # 嵌入产物同步（保证二进制内前端与仓库一致）
-          if [ -f web-embed/index.html ]; then :; fi
 
-      - name: 安装 Docker CLI（挂宿主 daemon）
-        run: apk add --no-cache docker-cli buildx >/dev/null
+      - name: 安装 QEMU binfmt（跨架构）
+        run: |
+          docker run --rm --privileged tonistiigi/binfmt:latest --install all 2>/dev/null \
+            || docker run --rm --privileged docker.m.daocloud.io/tonistiigi/binfmt:latest --install all
 
       - name: 计算 tag（以 APP_VERSION 为唯一版本源）
         id: meta
@@ -77,6 +86,7 @@ jobs:
             TAG_VER="${TAG_VER#v}"
             [ "$TAG_VER" = "$VER" ] || { echo "tag($TAG_VER) != APP_VERSION($VER)，拒绝发布" >&2; exit 1; }
           fi
+          echo "version=$VER" >> "$GITHUB_OUTPUT"
           echo "tags=${IMAGE}:${VER} ${IMAGE}:latest" >> "$GITHUB_OUTPUT"
 
       - name: 登录阿里云 ACR
@@ -84,20 +94,18 @@ jobs:
           ACR_USER: ${{ secrets.ACR_USERNAME }}
           ACR_PASS: ${{ secrets.ACR_PASSWORD }}
         run: |
-          PASS_LEN=${#ACR_PASS}
-          echo "ACR 用户: $ACR_USER (密码 ${PASS_LEN} 位)"
+          echo "ACR 用户: $ACR_USER (密码 ${#ACR_PASS} 位)"
           printf '%s' "$ACR_PASS" | docker login "$REGISTRY" -u "$ACR_USER" --password-stdin
 
-      - name: 多架构构建并推送
+      - name: buildx 多架构构建并推送
         env:
           TAGS: ${{ steps.meta.outputs.tags }}
-        # provenance/sbom 必须关：阿里云 ACR 不识别 OCI empty manifest（attestation），
-        # 否则报 "denied: unknown manifest class for application/vnd.oci.empty.v1+json"
         run: |
+          docker buildx create --name ci --driver docker-container --use 2>/dev/null || docker buildx use ci
           ARGS=""
           for t in $TAGS; do ARGS="$ARGS -t $t"; done
+          # provenance/sbom 必须关：阿里云 ACR 不识别 OCI empty manifest（attestation）
           docker buildx build \
-            --builder default \
             --platform linux/amd64,linux/arm64 \
             --provenance=false --sbom=false \
             --push \