diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index 1eed9e337..9a3c549af 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -85,15 +85,16 @@ jobs:
 
       # 2026-03-31 ogt: 移除中間通知，減少訊息雜訊
 
-      # ── Web 鏡像建置（含 Layer Cache 加速）──────────────────────────────
+      # ── Web 鏡像建置（強制無快取）──────────────────────────────
       # 2026-03-30 ogt: NEXT_PUBLIC_* 必須用公網域名 (build-time 寫死)
       # 內網 IP 會觸發瀏覽器「存取區域網路」權限對話框
+      # 2026-04-01 Claude Code: 移除 --cache-from，加 --no-cache
+      # 原因: BuildKit inline cache 導致 COPY . . 層被重用，CSRF fix 未進入 bundle
       - name: Build and Push Web
         run: |
           docker build -f apps/web/Dockerfile \
             --build-arg NEXT_PUBLIC_API_URL=https://awoooi.wooo.work \
-            --build-arg BUILDKIT_INLINE_CACHE=1 \
-            --cache-from ${{ env.HARBOR }}/awoooi/web:latest \
+            --no-cache \
             -t ${{ env.HARBOR }}/awoooi/web:${{ github.sha }} \
             -t ${{ env.HARBOR }}/awoooi/web:latest \
             .