diff --git a/.woodpecker/ci.yml b/.woodpecker/ci.yml
index 812c7e9..ef30457 100644
--- a/.woodpecker/ci.yml
+++ b/.woodpecker/ci.yml
@@ -1,11 +1,13 @@
 when:
-  - event: [push, pull_request, manual]
+  - event: [push, manual]
 
 clone:
-  git:
+  - name: git
     image: woodpeckerci/plugin-git:2.9.3
     settings:
-      remote: https://git.oeo.one/justme/WebDrop.git
+      remote:
+        from_secret: gitea_clone_webdrop
+      lfs: false
 
 steps:
   api-contract:
diff --git a/.woodpecker/release-backend.yml b/.woodpecker/release-backend.yml
index 6870bf4..e7d1ae1 100644
--- a/.woodpecker/release-backend.yml
+++ b/.woodpecker/release-backend.yml
@@ -3,10 +3,12 @@ when:
     ref: refs/tags/v*
 
 clone:
-  git:
+  - name: git
     image: woodpeckerci/plugin-git:2.9.3
     settings:
-      remote: https://git.oeo.one/justme/WebDrop.git
+      remote:
+        from_secret: gitea_clone_webdrop
+      lfs: false
 
 steps:
   release-checks:
diff --git a/docs/deployment.md b/docs/deployment.md
index 4d771da..d1ae7f3 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -34,7 +34,7 @@ CAPTCHA_SECRET=<server-side-secret>
 
 ## Woodpecker CI
 
-`.woodpecker/ci.yml` 在 push 和 pull request 上运行 API 契约、Core、Web、服务端检查，并解析后端 Compose 配置。每次更新都会构建前端。`.woodpecker/release-backend.yml` 仅响应 `vMAJOR.MINOR.PATCH` SemVer tag；测试通过后构建并推送同名后端镜像 tag。
+`.woodpecker/ci.yml` 在 push 和手动运行时执行 API 契约、Core、Web、服务端检查，并解析后端 Compose 配置。每次 push 都会构建前端。`.woodpecker/release-backend.yml` 仅响应 `vMAJOR.MINOR.PATCH` SemVer tag；测试通过后构建并推送同名后端镜像 tag。两者都通过 Woodpecker secret `gitea_clone_webdrop` 从 `https://git.oeo.one` 克隆私有仓库。
 
 后端镜像发布到 `zot.oeo.one/justme/webdrop-api`。在 Woodpecker 仓库配置 tag 事件可用的 secrets `registry_username`、`registry_password`。Docker Buildx 发布步骤以特权模式运行；Woodpecker Agent 必须将仓库设为 security trusted，并把 `woodpeckerci/plugin-docker-buildx:5.0.0` 加入服务端的 `WOODPECKER_PLUGINS_PRIVILEGED`。使用已发布镜像时，在 `.env` 中设置 `WEBDROP_IMAGE_TAG`；仓库名已填入 `.env.example`。