diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index db8c1cbfc..518020e2c 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -87,6 +87,7 @@ jobs:
       - name: Deploy to K8s
         env:
           SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          SUDO_PASSWORD: ${{ secrets.SUDO_PASSWORD }}
         run: |
           mkdir -p ~/.ssh
           echo "$SSH_PRIVATE_KEY" > ~/.ssh/deploy_key
@@ -95,21 +96,22 @@ jobs:
           set -e
           export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
 
-          echo "0936223270" | sudo -S kubectl set image deployment/awoooi-api \
+          # 2026-03-30 ogt: P0 安全修復 - 使用 secret 而非明文密碼
+          echo "$SUDO_PASSWORD" | sudo -S kubectl set image deployment/awoooi-api \
             api=192.168.0.110:5000/awoooi/api:${{ github.sha }} \
             -n awoooi-prod
 
-          echo "0936223270" | sudo -S kubectl set image deployment/awoooi-web \
+          echo "$SUDO_PASSWORD" | sudo -S kubectl set image deployment/awoooi-web \
             web=192.168.0.110:5000/awoooi/web:${{ github.sha }} \
             -n awoooi-prod
 
-          echo "0936223270" | sudo -S kubectl set image deployment/awoooi-worker \
+          echo "$SUDO_PASSWORD" | sudo -S kubectl set image deployment/awoooi-worker \
             worker=192.168.0.110:5000/awoooi/api:${{ github.sha }} \
             -n awoooi-prod
 
-          echo "0936223270" | sudo -S kubectl rollout status deployment/awoooi-api -n awoooi-prod --timeout=120s
-          echo "0936223270" | sudo -S kubectl rollout status deployment/awoooi-web -n awoooi-prod --timeout=120s
-          echo "0936223270" | sudo -S kubectl rollout status deployment/awoooi-worker -n awoooi-prod --timeout=120s
+          echo "$SUDO_PASSWORD" | sudo -S kubectl rollout status deployment/awoooi-api -n awoooi-prod --timeout=120s
+          echo "$SUDO_PASSWORD" | sudo -S kubectl rollout status deployment/awoooi-web -n awoooi-prod --timeout=120s
+          echo "$SUDO_PASSWORD" | sudo -S kubectl rollout status deployment/awoooi-worker -n awoooi-prod --timeout=120s
           echo "✅ 部署完成"
           DEPLOY