diff --git a/.gitea/workflows/docker-deploy.yml b/.gitea/workflows/docker-deploy.yml
index 796a063..aaeed62 100644
--- a/.gitea/workflows/docker-deploy.yml
+++ b/.gitea/workflows/docker-deploy.yml
@@ -22,7 +22,7 @@ jobs:
       SOURCE_REVISION: ${{ gitea.sha }}
       DEPLOY_PORT: ${{ vars.DEPLOY_PORT || '18082' }}
       PUBLIC_BASE_URL: ${{ vars.PUBLIC_BASE_URL || '' }}
-      CORS_ORIGINS: ${{ vars.CORS_ORIGINS || 'http://47.76.92.159:3001,http://47.76.92.159:3002,http://localhost:3001,http://localhost:3002' }}
+      CORS_ORIGINS: ${{ vars.CORS_ORIGINS || 'http://47.76.92.159:3000,http://47.76.92.159:3002,http://localhost:3000,http://localhost:3002' }}
       TEST_AUTH_ENABLED: ${{ vars.TEST_AUTH_ENABLED || 'true' }}
       POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
       TOKEN_SECRET: ${{ secrets.TOKEN_SECRET }}
@@ -33,7 +33,7 @@ jobs:
     steps:
       - name: Prepare runner and fetch exact revision
         env:
-          SOURCE_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          SOURCE_TOKEN: ${{ secrets.GITEA_TOKEN || gitea.token }}
         run: |
           set -eu
           apk add --no-cache python3 curl
@@ -62,8 +62,24 @@ jobs:
         if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
         run: |
           set -eu
-          test -n "$POSTGRES_PASSWORD"
-          test -n "$TOKEN_SECRET"
+          secret_volume=pk-lab-production-secrets
+          docker volume create "$secret_volume" >/dev/null
+          docker run --rm \
+            -e INITIAL_POSTGRES_PASSWORD="$POSTGRES_PASSWORD" \
+            -e INITIAL_TOKEN_SECRET="$TOKEN_SECRET" \
+            -v "$secret_volume:/secrets" \
+            alpine:3.20 sh -eu -c '
+              umask 077
+              if [ ! -s /secrets/postgres-password ]; then
+                if [ -n "$INITIAL_POSTGRES_PASSWORD" ]; then printf %s "$INITIAL_POSTGRES_PASSWORD" > /secrets/postgres-password; else head -c 48 /dev/urandom | base64 > /secrets/postgres-password; fi
+              fi
+              if [ ! -s /secrets/token-secret ]; then
+                if [ -n "$INITIAL_TOKEN_SECRET" ]; then printf %s "$INITIAL_TOKEN_SECRET" > /secrets/token-secret; else head -c 64 /dev/urandom | base64 > /secrets/token-secret; fi
+              fi
+            '
+          POSTGRES_PASSWORD="$(docker run --rm -v "$secret_volume:/secrets:ro" alpine:3.20 cat /secrets/postgres-password)"
+          TOKEN_SECRET="$(docker run --rm -v "$secret_volume:/secrets:ro" alpine:3.20 cat /secrets/token-secret)"
+          export POSTGRES_PASSWORD TOKEN_SECRET
           export DEPLOY_IMAGE="pk-lab-server:$SOURCE_REVISION"
           sh scripts/deploy.sh
           curl --fail --silent --show-error "http://127.0.0.1:$DEPLOY_PORT/health"
diff --git a/README.md b/README.md
index 0769528..ebc8932 100644
--- a/README.md
+++ b/README.md
@@ -11,7 +11,7 @@
 
 ## CI 所需配置
 
-Secrets：`GITEA_TOKEN`、`POSTGRES_PASSWORD`、`TOKEN_SECRET`，上线真实登录前再配置两套 `XHS_*_APP_ID/SECRET`。Variables：`DEPLOY_PORT`（默认 `18082`）、`PUBLIC_BASE_URL`、`CORS_ORIGINS`、`TEST_AUTH_ENABLED`。
+后端首次部署会在 Docker 命名卷 `pk-lab-production-secrets` 中自动生成并持久保存数据库密码和令牌密钥；也可在首次部署前配置 Secrets `POSTGRES_PASSWORD`、`TOKEN_SECRET`。上线真实登录前再配置两套 `XHS_*_APP_ID/SECRET`；拉取源码默认使用 Gitea 工作流自带令牌，也可用 `GITEA_TOKEN` 覆盖。Variables：`DEPLOY_PORT`（默认 `18082`）、`PUBLIC_BASE_URL`、`CORS_ORIGINS`、`TEST_AUTH_ENABLED`。默认允许 `3000`（综合版）和 `3002`（饭类独立版）访问。
 
 当前流水线默认 `TEST_AUTH_ENABLED=true`，让两个公网预览可以创建明确隔离的测试身份。接入真实小红书 App ID/Secret 后，必须把该变量改成 `false`，关闭 `dev:` 登录路径。
 
diff --git a/compose.yml b/compose.yml
index 4537516..a3e240f 100644
--- a/compose.yml
+++ b/compose.yml
@@ -31,7 +31,7 @@ services:
       DATABASE_URL: postgresql+psycopg://pk_lab:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}@postgres:5432/pk_lab
       TOKEN_SECRET: ${TOKEN_SECRET:?Set TOKEN_SECRET}
       PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-http://localhost:18082}
-      CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:3001,http://localhost:3002}
+      CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:3000,http://localhost:3002}
       TEST_AUTH_ENABLED: ${TEST_AUTH_ENABLED:-false}
       XHS_HUB_APP_ID: ${XHS_HUB_APP_ID:-}
       XHS_HUB_APP_SECRET: ${XHS_HUB_APP_SECRET:-}
@@ -44,4 +44,3 @@ services:
 volumes:
   postgres-data:
     name: pk-lab-postgres-data
-