diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index d244d4f..795cf34 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -116,6 +116,9 @@ jobs:
             -e SPRING_CLOUD_NACOS_CONFIG_NAMESPACE=6196f0de-a28d-4894-8f10-e2982b57c6bc \
             -e SPRING_CLOUD_NACOS_USERNAME=yh-reader \
             -e SPRING_CLOUD_NACOS_PASSWORD=123456 \
+            -e REDIS_PASSWORD=${{ secrets.REDIS_PASSWORD }} \
+            -e DB_PASSWORD=${{ secrets.DB_PASSWORD }} \
+            -e RABBITMQ_PASSWORD=${{ secrets.RABBITMQ_PASSWORD }} \
             "$IMG"
           # 健康检查：Spring 起来后 /userbase/ 返回 404（根路径无映射控制器），000 表示未起来
           OK=0
@@ -136,6 +139,9 @@ jobs:
               -e SPRING_CLOUD_NACOS_CONFIG_NAMESPACE=6196f0de-a28d-4894-8f10-e2982b57c6bc \
               -e SPRING_CLOUD_NACOS_USERNAME=yh-reader \
               -e SPRING_CLOUD_NACOS_PASSWORD=123456 \
+              -e REDIS_PASSWORD=${{ secrets.REDIS_PASSWORD }} \
+              -e DB_PASSWORD=${{ secrets.DB_PASSWORD }} \
+              -e RABBITMQ_PASSWORD=${{ secrets.RABBITMQ_PASSWORD }} \
               userbase-service:latest
             echo "rolled back"; exit 7
           fi
diff --git a/docker/application-prod.yml b/docker/application-prod.yml
index e1caeec..51bda44 100644
--- a/docker/application-prod.yml
+++ b/docker/application-prod.yml
@@ -20,20 +20,23 @@ spring:
     host: redis-server
     port: 6379
     database: 0
-    password: 'wv&WcDYAmLtqTIGM'
+    # 生产由 nacos application-infra.yaml 注入；此处仅作 nacos 不可达时的兜底，
+    # 密码不写死，运行时由容器环境变量 REDIS_PASSWORD 注入（值来自 Gitea Secrets，不入镜像）
+    password: ${REDIS_PASSWORD}
     timeout: 2000ms
   data:
     redis:
       repositories:
         enabled: false
 
-  datasource:
-    url: jdbc:mysql://mysql8:3306/bsch_userbase?useUnicode=true&characterEncoding=utf-8&useSSL=false&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true
-    username: root
-    password: 'CVf^x$sW*b6CGHxh'
-    driver-class-name: com.mysql.cj.jdbc.Driver
-    min-idle: 10
-    max-active: 30
+#  datasource:
+#    url: jdbc:mysql://mysql8:3306/bsch_userbase?useUnicode=true&characterEncoding=utf-8&useSSL=false&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true
+#    username: root
+#    # 生产由 nacos application-infra.yaml 注入；兜底密码运行时由 DB_PASSWORD 环境变量注入（来自 Gitea Secrets）
+#    password: ${DB_PASSWORD}
+#    driver-class-name: com.mysql.cj.jdbc.Driver
+#    min-idle: 10
+#    max-active: 30
 
   jpa:
     database: MySQL
@@ -51,7 +54,8 @@ spring:
     host: rabbitmq
     port: 5672
     username: admin
-    password: 'JdU29I#Q2E4yXoUl'
+    # 生产由 nacos application-infra.yaml 注入；兜底密码运行时由 RABBITMQ_PASSWORD 环境变量注入（来自 Gitea Secrets）
+    password: ${RABBITMQ_PASSWORD}
     listener:
       direct:
         auto-startup: false