diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index adae33c9d..b1c5a28e1 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -93,13 +93,33 @@ jobs:
 
       # 2026-03-31 ogt: 移除中間通知
 
-      - name: Deploy to K8s
+      # 2026-03-31 ogt: P0-1 Secrets 自動注入 (ADR-035 強制)
+      - name: Inject K8s Secrets
         env:
           SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          TG_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
+          TG_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
         run: |
           mkdir -p ~/.ssh
           echo "$SSH_PRIVATE_KEY" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
+          ssh -o StrictHostKeyChecking=no -i ~/.ssh/deploy_key wooo@192.168.0.121 << SECRETS
+          set -e
+          export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
+
+          # 注入 Telegram Secrets (ADR-035 鐵律)
+          sudo kubectl patch secret awoooi-secrets -n awoooi-prod --type='json' -p='[
+            {"op":"replace","path":"/data/OPENCLAW_TG_BOT_TOKEN","value":"'$(echo -n "${TG_BOT_TOKEN}" | base64)'"},
+            {"op":"replace","path":"/data/OPENCLAW_TG_CHAT_ID","value":"'$(echo -n "${TG_CHAT_ID}" | base64)'"}
+          ]' || echo "⚠️ Secrets patch 跳過 (可能尚未建立)"
+
+          echo "✅ Secrets 注入完成"
+          SECRETS
+
+      - name: Deploy to K8s
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
           ssh -o StrictHostKeyChecking=no -i ~/.ssh/deploy_key wooo@192.168.0.121 << 'DEPLOY'
           set -e
           export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
diff --git a/apps/api/models.json b/apps/api/models.json
index 0f18a5664..3e5425903 100644
--- a/apps/api/models.json
+++ b/apps/api/models.json
@@ -113,7 +113,7 @@
       "models": {
         "default": "nvidia/nemotron-mini-4b-instruct",
         "tool_calling": "nvidia/nemotron-mini-4b-instruct",
-        "rca": "nvidia/llama-3.1-nemotron-70b-instruct"
+        "rca": "nvidia/nemotron-mini-4b-instruct"
       },
       "options": {
         "temperature": 0.0,
diff --git a/docs/LOGBOOK.md b/docs/LOGBOOK.md
index 2061203c8..fcbfcecdd 100644
--- a/docs/LOGBOOK.md
+++ b/docs/LOGBOOK.md
@@ -70,7 +70,7 @@
 |-------|------|------|
 | 18.1 | AuditLog 表擴展 | ✅ 已完成 (欄位已存在) |
 | 18.2 | FailureWatcher Service | ✅ `8e2d7c3` |
-| 18.3 | K8s Executor 整合 | 🟡 待實作 |
+| 18.3 | K8s Executor 整合 | ✅ `770586d` |
 | 18.4 | OpenClaw 深度分析 | 🟡 待實作 |
 | 18.5 | Telegram 修復卡片 | ✅ 基礎整合 |
 | 18.6 | E2E 測試驗證 | 🟡 待實作 |