diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 79094d7..c4ad595 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -15,6 +15,10 @@ on:
         description: 'image tag (default = short sha)'
         required: false
         default: 'auto'
+      deploy:
+        description: 'deploy to 160 after build (auto / skip)'
+        required: false
+        default: 'auto'
 
 jobs:
   build-and-push:
@@ -76,5 +80,37 @@ jobs:
       - name: Push image
         run: docker push nexus:8083/docker-hosted/userbase-service:${{ steps.meta.outputs.tag }}
 
-      - name: Report
+      - name: Report build
         run: echo "pushed nexus:8083/docker-hosted/userbase-service:${{ steps.meta.outputs.tag }}"
+
+      # —— 部署阶段（仅在 push 或手动 dispatch deploy=auto 时执行）——
+      # 运行在 160 的 act_runner 上，复用宿主 docker daemon（docker.sock 由 act_runner 自动挂载），
+      # 因此 docker pull / run 直接作用于 160 宿主，等价于在 160 上执行部署。
+      - name: Deploy (pull + rollout with rollback)
+        if: github.event_name == 'push' || inputs.deploy == 'auto'
+        run: |
+          set +e
+          IMG=nexus:8083/docker-hosted/userbase-service:${{ steps.meta.outputs.tag }}
+          echo "deploying $IMG"
+          echo "${{ secrets.NEXUS_PASSWORD }}" | docker login nexus:8083 -u ${{ secrets.NEXUS_USER }} --password-stdin
+          docker pull "$IMG"
+          # 回滚锚：保留当前 userbase-service:latest（已知良好镜像），再额外打一个时间点标签
+          RB=userbase-service:rb-$(date +%s)
+          docker tag userbase-service:latest "$RB" 2>/dev/null || true
+          docker stop userbase-service 2>/dev/null; docker rm -f userbase-service 2>/dev/null
+          docker run -d --name userbase-service --restart unless-stopped --network infra-infra-net -p 8060:8060 "$IMG"
+          # 健康检查：Spring 起来后 /userbase/ 返回 404（根路径无映射控制器），000 表示未起来
+          OK=0
+          for i in $(seq 1 30); do
+            sleep 5
+            CODE=$(curl -s -o /dev/null -w '%{http_code}' http://localhost:8060/userbase/ 2>/dev/null || true)
+            if [ "$CODE" != "000" ]; then OK=1; break; fi
+          done
+          if [ "$OK" = "0" ]; then
+            echo "!! UNHEALTHY -> rollback to userbase-service:latest"
+            docker stop userbase-service 2>/dev/null; docker rm -f userbase-service 2>/dev/null
+            docker run -d --name userbase-service --restart unless-stopped --network infra-infra-net -p 8060:8060 userbase-service:latest
+            echo "rolled back"; exit 7
+          fi
+          echo "DEPLOY OK: $IMG"
+          docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Image}}' | grep userbase || true