diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index ec34326..7de4ac5 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -67,3 +67,38 @@ jobs:
             "docker login git.olns.shop -u admin --password-stdin"
           ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
             "cd /opt/olns && docker compose pull im-server && docker compose up -d --no-deps --wait im-server"
+
+      - name: Inspect production IM CORS routing
+        env:
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
+        run: |
+          set -euo pipefail
+          install -d -m 700 "$HOME/.ssh"
+          KEY_FILE="$(mktemp "$HOME/.ssh/olns-diagnose.XXXXXX")"
+          cleanup() {
+            shred -u "$KEY_FILE" 2>/dev/null || true
+          }
+          trap cleanup EXIT
+          printf '%s\n' "$DEPLOY_SSH_KEY" > "$KEY_FILE"
+          chmod 600 "$KEY_FILE"
+          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
+          chmod 600 "$HOME/.ssh/known_hosts"
+          SSH_ARGS=(-i "$KEY_FILE" -o BatchMode=yes -o StrictHostKeyChecking=yes)
+          ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" '
+            set -e
+            echo "Production compose services:"
+            cd /opt/olns
+            docker compose config --services
+            echo "IM API and CORS routing references:"
+            grep -RIn \
+              --include="Caddyfile" \
+              --include="*.caddy" \
+              --include="*.conf" \
+              --include="*.yml" \
+              --include="*.yaml" \
+              -E "im-api\.yuexuan\.shop|Access-Control-Allow-Origin" \
+              /opt/olns 2>/dev/null || true
+            echo "Running reverse-proxy containers:"
+            docker ps --format "{{.Names}} {{.Image}}" | grep -Ei "caddy|nginx|traefik|proxy" || true
+          '