diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index c6af321..eb16958 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -1,10 +1,10 @@
-name: Deploy Backend (Blue-Green)
+name: Deploy im-server (k3s test cluster)
 
 on:
   workflow_dispatch:
     inputs:
       image_tag:
-        description: '镜像tag，留空则使用commit短哈希'
+        description: '镜像tag，默认为 test（与集群 kustomization 里的 newTag 一致）'
         required: false
 
 jobs:
@@ -17,32 +17,22 @@ jobs:
         id: vars
         run: |
           TAG="${{ github.event.inputs.image_tag }}"
-          [ -z "$TAG" ] && TAG=$(git rev-parse --short HEAD)
+          [ -z "$TAG" ] && TAG=test
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
-      - name: 构建镜像(从本仓库源码编译，非下载官方release)
-        run: docker build -t im-server:${{ steps.vars.outputs.tag }} -f docker/tinode/Dockerfile.build .
+      - name: 登录镜像仓库
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.118im.com -u admin --password-stdin
 
-      - name: 校验后台治理启动配置
-        env:
-          ADMIN_INTERNAL_API_BASE_URL: ${{ secrets.ADMIN_INTERNAL_API_BASE_URL }}
-          ADMIN_INTERNAL_API_SECRET: ${{ secrets.ADMIN_INTERNAL_API_SECRET }}
-          INTERNAL_API_HOTGO_SECRET: ${{ secrets.INTERNAL_API_HOTGO_SECRET }}
+      - name: 构建并推送镜像(从本仓库源码编译，不是官方预编译包)
         run: |
-          test -n "$ADMIN_INTERNAL_API_BASE_URL" || { echo "missing secret: ADMIN_INTERNAL_API_BASE_URL"; exit 1; }
-          test -n "$ADMIN_INTERNAL_API_SECRET" || { echo "missing secret: ADMIN_INTERNAL_API_SECRET"; exit 1; }
-          test -n "$INTERNAL_API_HOTGO_SECRET" || { echo "missing secret: INTERNAL_API_HOTGO_SECRET"; exit 1; }
+          docker build -f docker/tinode/Dockerfile.build \
+            -t git.118im.com/im_team/im-server:${{ steps.vars.outputs.tag }} .
+          docker push git.118im.com/im_team/im-server:${{ steps.vars.outputs.tag }}
 
-      - name: 蓝绿部署
-        env:
-          MYSQL_DSN: ${{ secrets.MYSQL_DSN }}
-          REDIS_ADDR: ${{ secrets.REDIS_ADDR }}
-          REDIS_PASSWORD: ${{ secrets.REDIS_PASSWORD }}
-          API_KEY_SALT: ${{ secrets.API_KEY_SALT }}
-          AUTH_TOKEN_KEY: ${{ secrets.AUTH_TOKEN_KEY }}
-          UID_ENCRYPTION_KEY: ${{ secrets.UID_ENCRYPTION_KEY }}
-          ADMIN_INTERNAL_API_BASE_URL: ${{ secrets.ADMIN_INTERNAL_API_BASE_URL }}
-          ADMIN_INTERNAL_API_SECRET: ${{ secrets.ADMIN_INTERNAL_API_SECRET }}
-          INTERNAL_API_HOTGO_SECRET: ${{ secrets.INTERNAL_API_HOTGO_SECRET }}
+      - name: 部署到k3s测试集群
         run: |
-          IMAGE=im-server:${{ steps.vars.outputs.tag }} /opt/apps/im-server/deploy.sh
+          mkdir -p ~/.kube
+          echo "${{ secrets.KUBECONFIG }}" > ~/.kube/config
+          chmod 600 ~/.kube/config
+          kubectl rollout restart deployment/im-server -n im-server-system
+          kubectl rollout status deployment/im-server -n im-server-system --timeout=120s