diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index bc4e496..6ef5af5 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -23,6 +23,24 @@ jobs:
       - name: 构建镜像(从本仓库源码编译，非下载官方release)
         run: docker build -t im-server:${{ steps.vars.outputs.tag }} -f docker/tinode/Dockerfile.build .
 
+      - name: 校验后台治理启动配置
+        env:
+          KAFKA_BROKERS_JSON: ${{ secrets.KAFKA_BROKERS_JSON }}
+          KAFKA_SASL_MECHANISM: ${{ secrets.KAFKA_SASL_MECHANISM }}
+          KAFKA_SASL_USERNAME: ${{ secrets.KAFKA_SASL_USERNAME }}
+          KAFKA_SASL_PASSWORD: ${{ secrets.KAFKA_SASL_PASSWORD }}
+          ADMIN_INTERNAL_API_BASE_URL: ${{ secrets.ADMIN_INTERNAL_API_BASE_URL }}
+          ADMIN_INTERNAL_API_SECRET: ${{ secrets.ADMIN_INTERNAL_API_SECRET }}
+          INTERNAL_API_HOTGO_SECRET: ${{ secrets.INTERNAL_API_HOTGO_SECRET }}
+        run: |
+          test -n "$KAFKA_BROKERS_JSON" || { echo "missing secret: KAFKA_BROKERS_JSON"; exit 1; }
+          test -n "$KAFKA_SASL_MECHANISM" || { echo "missing secret: KAFKA_SASL_MECHANISM"; exit 1; }
+          test -n "$KAFKA_SASL_USERNAME" || { echo "missing secret: KAFKA_SASL_USERNAME"; exit 1; }
+          test -n "$KAFKA_SASL_PASSWORD" || { echo "missing secret: KAFKA_SASL_PASSWORD"; exit 1; }
+          test -n "$ADMIN_INTERNAL_API_BASE_URL" || { echo "missing secret: ADMIN_INTERNAL_API_BASE_URL"; exit 1; }
+          test -n "$ADMIN_INTERNAL_API_SECRET" || { echo "missing secret: ADMIN_INTERNAL_API_SECRET"; exit 1; }
+          test -n "$INTERNAL_API_HOTGO_SECRET" || { echo "missing secret: INTERNAL_API_HOTGO_SECRET"; exit 1; }
+
       - name: 蓝绿部署
         env:
           MYSQL_DSN: ${{ secrets.MYSQL_DSN }}
@@ -31,7 +49,20 @@ jobs:
           API_KEY_SALT: ${{ secrets.API_KEY_SALT }}
           AUTH_TOKEN_KEY: ${{ secrets.AUTH_TOKEN_KEY }}
           UID_ENCRYPTION_KEY: ${{ secrets.UID_ENCRYPTION_KEY }}
+          KAFKA_ENABLED: "true"
+          KAFKA_BROKERS_JSON: ${{ secrets.KAFKA_BROKERS_JSON }}
+          KAFKA_CLIENT_ID: im-server
+          KAFKA_CONSUMER_GROUP: im-server
+          KAFKA_SASL_ENABLED: "true"
+          KAFKA_SASL_MECHANISM: ${{ secrets.KAFKA_SASL_MECHANISM }}
+          KAFKA_SASL_USERNAME: ${{ secrets.KAFKA_SASL_USERNAME }}
+          KAFKA_SASL_PASSWORD: ${{ secrets.KAFKA_SASL_PASSWORD }}
+          INTERNAL_API_ENABLED: "true"
+          INTERNAL_API_TIME_WINDOW_SECONDS: "300"
+          INTERNAL_API_HOTGO_SERVICE_NAME: hotgo-admin
           ADMIN_INTERNAL_API_BASE_URL: ${{ secrets.ADMIN_INTERNAL_API_BASE_URL }}
+          ADMIN_INTERNAL_API_ENABLED: "true"
+          ADMIN_INTERNAL_API_SERVICE_NAME: im-server
           ADMIN_INTERNAL_API_SECRET: ${{ secrets.ADMIN_INTERNAL_API_SECRET }}
           INTERNAL_API_HOTGO_SECRET: ${{ secrets.INTERNAL_API_HOTGO_SECRET }}
         run: |
diff --git a/docker/tinode/config.template b/docker/tinode/config.template
index 0f52852..56792ba 100644
--- a/docker/tinode/config.template
+++ b/docker/tinode/config.template
@@ -151,17 +151,17 @@
 		}
 	},
 	"internal_api": {
-		"enabled": true,
-		"time_window_seconds": 300,
+		"enabled": $INTERNAL_API_ENABLED,
+		"time_window_seconds": $INTERNAL_API_TIME_WINDOW_SECONDS,
 		"services": {
-			"hotgo-admin": {
+			"$INTERNAL_API_HOTGO_SERVICE_NAME": {
 				"secret": "$INTERNAL_API_HOTGO_SECRET",
 				"allow": ["admin_query"]
 			}
 		}
 	},
 	"admin_internal_api": {
-		"enabled": true,
+		"enabled": $ADMIN_INTERNAL_API_ENABLED,
 		"base_url": "$ADMIN_INTERNAL_API_BASE_URL",
 		"service_name": "$ADMIN_INTERNAL_API_SERVICE_NAME",
 		"secret": "$ADMIN_INTERNAL_API_SECRET",