diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 77cf4a8..2063465 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -24,13 +24,44 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        env:
+          HTTP_PROXY: http://10.0.2.2:7890
+          HTTPS_PROXY: http://10.0.2.2:7890
+          ALL_PROXY: socks5://10.0.2.2:7891
+          NO_PROXY: localhost,127.0.0.1,.svc,.cluster.local,gitea-http.gitea.svc.cluster.local,git.luochen570.cn,docker.gitea.com
+        run: |
+          set -euo pipefail
+          git init .
+          if git remote get-url origin >/dev/null 2>&1; then
+            git remote set-url origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
+          else
+            git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
+          fi
+          git fetch --depth=1 origin "$GITHUB_SHA"
+          git checkout --detach FETCH_HEAD
+          git submodule update --init --recursive --depth=1
 
       - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v3
-        with:
-          hugo-version: '0.161.1'
-          extended: true
+        env:
+          HTTP_PROXY: http://10.0.2.2:7890
+          HTTPS_PROXY: http://10.0.2.2:7890
+          ALL_PROXY: socks5://10.0.2.2:7891
+          NO_PROXY: localhost,127.0.0.1,.svc,.cluster.local,gitea-http.gitea.svc.cluster.local,git.luochen570.cn,docker.gitea.com
+        run: |
+          set -euo pipefail
+          HUGO_VERSION="0.161.1"
+          HUGO_DEB="hugo_extended_${HUGO_VERSION}_linux-amd64.deb"
+          HUGO_URL="https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/${HUGO_DEB}"
+
+          if command -v hugo >/dev/null 2>&1 && hugo version | grep -F "v${HUGO_VERSION}" >/dev/null; then
+            hugo version
+            exit 0
+          fi
+
+          curl -fsSLo "/tmp/${HUGO_DEB}" "$HUGO_URL"
+          apt-get update
+          apt-get install -y --no-install-recommends "/tmp/${HUGO_DEB}"
+          hugo version
 
       - name: Hugo Build
         run: hugo --minify
@@ -42,7 +73,6 @@ jobs:
           set -euo pipefail
 
           # k3s dind-rootless runner: use rootless Docker Unix socket.
-          # Avoid the unverified TCP Docker API path here.
           export DOCKER_HOST="${DOCKER_HOST}"
           unset DOCKER_TLS_VERIFY DOCKER_CERT_PATH DOCKER_CONTEXT
 
@@ -55,13 +85,14 @@ jobs:
             exit 1
           fi
 
+          IMAGE_TAG="${GITHUB_SHA}"
           docker version
           echo "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u luochen570 --password-stdin
           docker build \
-            -t "$REGISTRY/$IMAGE:${{ github.sha }}" \
+            -t "$REGISTRY/$IMAGE:$IMAGE_TAG" \
             -t "$REGISTRY/$IMAGE:latest" \
             .
-          docker push "$REGISTRY/$IMAGE:${{ github.sha }}"
+          docker push "$REGISTRY/$IMAGE:$IMAGE_TAG"
           docker push "$REGISTRY/$IMAGE:latest"
 
       - name: Deploy to k3s
@@ -90,17 +121,22 @@ jobs:
               get ingress "$K8S_INGRESS" -n "$K8S_NAMESPACE" \
               --ignore-not-found \
               -o jsonpath='{range .spec.rules[*]}{.host}{"\n"}{end}{range .spec.tls[*].hosts[*]}{.}{"\n"}{end}')"
-            printf '%s\n' "$ingress_hosts" | grep -Fx "$TEST_HOST" >/dev/null
-            if printf '%s\n' "$ingress_hosts" | grep -Fx "$PROD_HOST" >/dev/null; then
-              echo "Refusing deploy: ingress contains production host $PROD_HOST" >&2
-              exit 1
+            printf '%s\n' "$ingress_hosts" | grep -Fx "$PROD_HOST" >/dev/null
+            if printf '%s\n' "$ingress_hosts" | grep -Fx "$TEST_HOST" >/dev/null; then
+              echo "Ingress also contains test host $TEST_HOST; continuing because production host $PROD_HOST is present"
             fi
           else
             echo "Kubeconfig cannot read ingresses; relying on K8S_NAMESPACE/K8S_DEPLOYMENT scope: $K8S_NAMESPACE/$K8S_DEPLOYMENT"
           fi
 
+          IMAGE_REF="$REGISTRY/$IMAGE:${GITHUB_SHA}"
           /tmp/kubectl --kubeconfig "$KUBECONFIG_FILE" \
             set image "deployment/$K8S_DEPLOYMENT" -n "$K8S_NAMESPACE" \
-            "$K8S_CONTAINER=$REGISTRY/$IMAGE:${{ github.sha }}"
+            "$K8S_CONTAINER=$IMAGE_REF"
+          /tmp/kubectl --kubeconfig "$KUBECONFIG_FILE" \
+            annotate "deployment/$K8S_DEPLOYMENT" -n "$K8S_NAMESPACE" \
+            "hugo.luochen570.cn/git-sha=${GITHUB_SHA}" \
+            "hugo.luochen570.cn/image=$IMAGE_REF" \
+            --overwrite
           /tmp/kubectl --kubeconfig "$KUBECONFIG_FILE" \
             rollout status "deployment/$K8S_DEPLOYMENT" -n "$K8S_NAMESPACE" --timeout=120s
diff --git a/deploy/hugo-ingress.yaml b/deploy/hugo-ingress.yaml
index 5ff4565..15f5c6f 100644
--- a/deploy/hugo-ingress.yaml
+++ b/deploy/hugo-ingress.yaml
@@ -18,7 +18,20 @@ spec:
             name: hugo-blog
             port:
               number: 80
+  - host: hugo.luochen570.cn
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: hugo-blog
+            port:
+              number: 80
   tls:
   - hosts:
     - hugo.test.luochen570.cn
     secretName: hugo-test-luochen570-cn-tls
+  - hosts:
+    - hugo.luochen570.cn
+    secretName: hugo-luochen570-cn-tls