diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 06d967f..fe5f459 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -123,7 +123,21 @@ jobs:
           chmod 600 "$KUBECONFIG_FILE"
 
           KUBECTL_VERSION="v1.32.0"
-          curl -fsSLo /tmp/kubectl "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
+          download_kubectl() {
+            local proxy_name="$1"
+            shift
+            echo "Trying kubectl download via ${proxy_name}"
+            rm -f /tmp/kubectl
+            env "$@" curl -fL --connect-timeout 20 --retry 5 --retry-all-errors --retry-delay 5 \
+              -o /tmp/kubectl "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
+          }
+
+          download_kubectl "direct" \
+            HTTP_PROXY= HTTPS_PROXY= ALL_PROXY= http_proxy= https_proxy= all_proxy= \
+          || download_kubectl "cluster mihomo" \
+            HTTP_PROXY=http://mihomo.mihomo.svc.cluster.local:7890 HTTPS_PROXY=http://mihomo.mihomo.svc.cluster.local:7890 ALL_PROXY=socks5://mihomo.mihomo.svc.cluster.local:7890 \
+            http_proxy=http://mihomo.mihomo.svc.cluster.local:7890 https_proxy=http://mihomo.mihomo.svc.cluster.local:7890 all_proxy=socks5://mihomo.mihomo.svc.cluster.local:7890 \
+            NO_PROXY=localhost,127.0.0.1,.svc,.cluster.local,gitea-http.gitea.svc.cluster.local,git.luochen570.cn,mihomo.mihomo.svc.cluster.local
           chmod +x /tmp/kubectl
 
           if /tmp/kubectl --kubeconfig "$KUBECONFIG_FILE" \