diff --git a/.gitea/scripts/push-to-nexus.sh b/.gitea/scripts/push-to-nexus.sh
new file mode 100644
index 0000000..e17d33e
--- /dev/null
+++ b/.gitea/scripts/push-to-nexus.sh
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# 推送 NuGet 包到 Nexus nuget-hosted 仓库。
+#
+# 关键点：
+#   1. Nexus 的 NuGet 推送认证走 HTTP Basic（账号+密码），不校验 api-key；
+#   2. Nexus 为 http 源，SDK 8 需在 nuget.config 显式 allowInsecureConnections="true"；
+#   3. dotnet nuget push 不支持 --configfile，只读取当前目录/用户级 nuget.config，故在此动态生成；
+#   4. nuget-hosted 为 Disable redeploy（ALLOW_ONCE），重复包返回 400，
+#      先调用 Nexus REST API 查重，已存在则跳过。
+set -euo pipefail
+
+echo "==> 生成带凭据的 nuget.config"
+cat > nuget.config <<EOF
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <packageSources>
+    <clear />
+    <add key="nexus-nuget" value="${NEXUS_URL}" allowInsecureConnections="true" />
+  </packageSources>
+  <packageSourceCredentials>
+    <nexus-nuget>
+      <add key="Username" value="${NEXUS_USER}" />
+      <add key="ClearTextPassword" value="${NEXUS_PASS}" />
+    </nexus-nuget>
+  </packageSourceCredentials>
+</configuration>
+EOF
+
+BASE="${NEXUS_URL%/repository/nuget-hosted/index.json}"
+AUTH="Basic $(printf '%s:%s' "$NEXUS_USER" "$NEXUS_PASS" | base64 -w0)"
+
+pushed=0
+skipped=0
+failed=0
+
+for pkg in BasePlatformDotnet/artifacts/*.nupkg; do
+  [ -e "$pkg" ] || continue
+
+  # 优先从 nuspec 解析 id/version；失败则从文件名兜底解析
+  nuspec="$(unzip -p "$pkg" '*.nuspec' 2>/dev/null || true)"
+  id="$(printf '%s' "$nuspec" | grep -oP '(?<=<id>)[^<]+' | head -1 || true)"
+  ver="$(printf '%s' "$nuspec" | grep -oP '(?<=<version>)[^<]+' | head -1 || true)"
+  if [ -z "$id" ] || [ -z "$ver" ]; then
+    base="$(basename "$pkg" .nupkg)"
+    ver="$(printf '%s' "$base" | grep -oP '[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z][0-9A-Za-z.-]*)?$' || true)"
+    id="$(printf '%s' "$base" | sed -E "s/\.${ver//./\.}$//")"
+  fi
+  if [ -z "$id" ] || [ -z "$ver" ]; then
+    echo "WARN: 无法解析 $pkg 的 id/version，跳过"
+    skipped=$((skipped+1))
+    continue
+  fi
+
+  # 查重：Disable redeploy 下重复包返回 400
+  if curl -sf -H "Authorization: $AUTH" \
+      "$BASE/service/rest/v1/search?repository=nuget-hosted&name=$id&version=$ver" \
+      | grep -q '"name"'; then
+    echo "SKIP: $id $ver 已存在（Disable redeploy）"
+    skipped=$((skipped+1))
+    continue
+  fi
+
+  if dotnet nuget push "$pkg" --source nexus-nuget --api-key nexus; then
+    echo "PUSHED: $id $ver"
+    pushed=$((pushed+1))
+  else
+    echo "FAILED: $id $ver"
+    failed=$((failed+1))
+  fi
+done
+
+echo "==> 推送结果: pushed=$pushed skipped=$skipped failed=$failed"
+[ "$failed" -eq 0 ]
\ No newline at end of file
diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index aefe9ab..5cce415 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -69,23 +69,10 @@ jobs:
         run: dotnet pack BasePlatformDotnet/yh-platform-net.sln -c Release -o BasePlatformDotnet/artifacts
 
       - name: Push to Nexus
-        # Nexus 的 NuGet 推送认证走 HTTP Basic（账号+密码），不校验 api-key；
-        # 且 Nexus 为 http 源，SDK 8 需在 nuget.config 显式 allowInsecureConnections=true。
-        # 动态生成带凭据的 nuget.config 并指定 --configfile，避免凭据入 git。
-        run: |
-          cat > nuget-push.config <<EOF
-          <?xml version="1.0" encoding="utf-8"?>
-          <configuration>
-            <packageSources>
-              <clear />
-              <add key="nexus-nuget" value="${{ secrets.NEXUS_URL }}" allowInsecureConnections="true" />
-            </packageSources>
-            <packageSourceCredentials>
-              <nexus-nuget>
-                <add key="Username" value="${{ secrets.NEXUS_USER }}" />
-                <add key="ClearTextPassword" value="${{ secrets.NEXUS_PASS }}" />
-              </nexus-nuget>
-            </packageSourceCredentials>
-          </configuration>
-          EOF
-          dotnet nuget push "BasePlatformDotnet/artifacts/*.nupkg" --source nexus-nuget --configfile nuget-push.config --api-key nexus
\ No newline at end of file
+        # 委托独立脚本：生成带凭据 nuget.config（dotnet nuget push 不支持 --configfile）、
+        # 按 Disable redeploy 策略先查重再推送，凭据全部走 Gitea Secrets，不入 git。
+        env:
+          NEXUS_URL: ${{ secrets.NEXUS_URL }}
+          NEXUS_USER: ${{ secrets.NEXUS_USER }}
+          NEXUS_PASS: ${{ secrets.NEXUS_PASS }}
+        run: bash .gitea/scripts/push-to-nexus.sh
\ No newline at end of file