diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 5da1f51..288a54e 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -25,23 +25,18 @@ jobs:
 
       # 用宿主 docker 守护进程跑 maven（--network=host 走宿主外网拉依赖），
       # 产出 target/userbase.jar 落到工作区。
-      - name: Build jar (maven, host network)
-        run: docker run --rm --network=host -v $PWD:/build -w /build maven:3.9-eclipse-temurin-8 mvn -B -DskipTests package
+      - name: Build jar (maven, host network, nexus maven-public)
+        # maven-settings.xml 将 central 指向 nexus maven-public（含内部 SNAPSHOT BOM 与 central 代理）
+        run: docker run --rm --network=host -v $PWD:/build -w /build maven:3.9-eclipse-temurin-8 mvn -s maven-settings.xml -B -DskipTests package
 
-      - name: Login to Nexus docker registry
-        # 单引号包裹 secret，避免密码中的 $ 被 shell 展开
-        run: echo '${{ secrets.NEXUS_PASSWORD }}' | docker login -u '${{ secrets.NEXUS_USER }}' --password-stdin 192.168.10.160:8083
-
-      - name: Build image
-        run: docker build -f docker/Dockerfile -t 192.168.10.160:8083/docker-hosted/userbase-service:latest .
-
-      - name: Push image
-        run: docker push 192.168.10.160:8083/docker-hosted/userbase-service:latest
+      - name: Build image on host daemon
+        run: docker build -f docker/Dockerfile -t userbase-service:latest .
 
       - name: Deploy on host (infra-infra-net)
+        # 镜像已在宿主本地，直接运行，无需推送到 nexus（nexus docker 仓库为 HTTP，需 daemon insecure-registries 才能推送）
         run: |
           docker rm -f userbase-service 2>/dev/null || true
-          docker run -d --name userbase-service --network infra-infra-net -p 8060:8060 --restart unless-stopped 192.168.10.160:8083/docker-hosted/userbase-service:latest
+          docker run -d --name userbase-service --network infra-infra-net -p 8060:8060 --restart unless-stopped userbase-service:latest
 
       - name: Done
         run: 'echo "UserBaseService deployed -> http://192.168.10.160:8060/userbase"'
diff --git a/maven-settings.xml b/maven-settings.xml
new file mode 100644
index 0000000..6fee94c
--- /dev/null
+++ b/maven-settings.xml
@@ -0,0 +1,26 @@
+<settings>
+  <profiles>
+    <profile>
+      <id>nexus</id>
+      <repositories>
+        <repository>
+          <id>central</id>
+          <url>http://192.168.10.160:8081/repository/maven-public/</url>
+          <releases><enabled>true</enabled></releases>
+          <snapshots><enabled>true</enabled></snapshots>
+        </repository>
+      </repositories>
+      <pluginRepositories>
+        <pluginRepository>
+          <id>central</id>
+          <url>http://192.168.10.160:8081/repository/maven-public/</url>
+          <releases><enabled>true</enabled></releases>
+          <snapshots><enabled>true</enabled></snapshots>
+        </pluginRepository>
+      </pluginRepositories>
+    </profile>
+  </profiles>
+  <activeProfiles>
+    <activeProfile>nexus</activeProfile>
+  </activeProfiles>
+</settings>