diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 54ef49f..a0fabdb 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -23,19 +23,15 @@ jobs:
           rm -rf .git .gitea
           rm -rf /tmp/src
 
-      - name: Login to Nexus docker registry
-        run: echo '${{ secrets.NEXUS_PASSWORD }}' | docker login -u '${{ secrets.NEXUS_USER }}' --password-stdin 192.168.10.160:8083
-
-      - name: Build image (copies docker/cas.war)
-        run: docker build -f docker/Dockerfile -t 192.168.10.160:8083/docker-hosted/cassso-service:latest .
-
-      - name: Push image
-        run: docker push 192.168.10.160:8083/docker-hosted/cassso-service:latest
+      - name: Build image (copies docker/cas.war) on host daemon
+        # 经由挂载的 docker.sock 在宿主守护进程上构建，镜像直接落在宿主本地
+        run: docker build -f docker/Dockerfile -t cassso-service:latest .
 
       - name: Deploy on host (infra-infra-net, CAS 端口 8443)
+        # 镜像已在宿主本地，直接运行，无需推送到 nexus（nexus docker 仓库为 HTTP，需 daemon insecure-registries 才能推送）
         run: |
           docker rm -f cas-sso 2>/dev/null || true
-          docker run -d --name cas-sso --network infra-infra-net -p 8443:8443 --restart unless-stopped 192.168.10.160:8083/docker-hosted/cassso-service:latest
+          docker run -d --name cas-sso --network infra-infra-net -p 8443:8443 --restart unless-stopped cassso-service:latest
 
       - name: Done
         run: 'echo "CasSsoService deployed -> https://192.168.10.160:8443/login"'