diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index a62b734..d4edf24 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -10,12 +10,28 @@ jobs:
     runs-on: runner_admin
     steps:
       - name: 检出代码
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
         run: |
           set -eux
+          TAG="${GITHUB_REF_NAME:-${GITEA_REF_NAME:-}}"
+          if [ -z "$TAG" ] && [ -n "${GITHUB_REF:-}" ]; then
+            TAG="${GITHUB_REF##*/}"
+          fi
+          if [ -z "$TAG" ]; then
+            echo "无法识别触发标签"
+            env | sort
+            exit 1
+          fi
+          printf '%s' "$TAG" > /tmp/lightops-release-tag
           rm -rf lightops-src
-          git clone https://gitea.kmux.cn/Eeveid/lightOps.git lightops-src
+          if [ -n "${GITEA_TOKEN:-}" ]; then
+            git clone "https://oauth2:${GITEA_TOKEN}@gitea.kmux.cn/Eeveid/lightOps.git" lightops-src
+          else
+            git clone https://gitea.kmux.cn/Eeveid/lightOps.git lightops-src
+          fi
           cd lightops-src
-          TAG="${GITHUB_REF_NAME:-${GITEA_REF_NAME:-${GITHUB_REF##*/}}}"
+          git fetch --tags --force
           git checkout "$TAG"
 
       - name: 安装系统依赖
@@ -47,7 +63,7 @@ jobs:
           set -eux
           . "$HOME/.cargo/env" 2>/dev/null || true
           cd lightops-src
-          TAG="${GITHUB_REF_NAME:-${GITEA_REF_NAME:-${GITHUB_REF##*/}}}"
+          TAG="$(cat /tmp/lightops-release-tag)"
           VERSION="${TAG#v}"
           bash scripts/build-release.sh --version "$VERSION" --target x86_64-unknown-linux-gnu
 
@@ -60,11 +76,12 @@ jobs:
         run: |
           set -eux
           cd lightops-src
-          TAG="${GITHUB_REF_NAME:-${GITEA_REF_NAME:-${GITHUB_REF##*/}}}"
+          TAG="$(cat /tmp/lightops-release-tag)"
+          TARGET_SHA="$(git rev-parse HEAD)"
           bash scripts/publish-gitea-release.sh \
             --tag "$TAG" \
             --title "LightOps ${TAG}" \
-            --target "$GITHUB_SHA" \
+            --target "$TARGET_SHA" \
             --no-create-tag \
             --no-push-tag \
             --package target/releases/*.tar.gz \