diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 71eeda5..2464c06 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -2,6 +2,11 @@ name: build
 on:
   push:
     branches: [main]
+    # CI 最後一步會 commit 回 manifests/deployment.yaml（更新
+    # image tag），排除這個路徑避免那次 commit 又觸發一輪新的
+    # build，形成無限迴圈。
+    paths-ignore:
+      - manifests/**
 
 jobs:
   build-and-push:
@@ -20,7 +25,7 @@ jobs:
         run: |
           mkdir -p ~/.docker
           echo '{}' > ~/.docker/config.json
-          echo "${{ secrets.CI_REGISTRY_TOKEN }}" | docker login gitea.niq-dev.com -u "${{ gitea.actor }}" --password-stdin
+          echo "${{ secrets.REGISTRY_PUSH_TOKEN }}" | docker login gitea.niq-dev.com -u "${{ gitea.actor }}" --password-stdin
 
       - name: Build image
         run: docker build -t gitea.niq-dev.com/gitea_admin/landing:${{ gitea.sha }} -t gitea.niq-dev.com/gitea_admin/landing:latest .
@@ -41,7 +46,7 @@ jobs:
         # sha256: 開頭的 digest 記錄不主動處理，避免誤刪或刪掉
         # 還在被引用的 manifest。
         run: |
-          curl -s -H "Authorization: token ${{ secrets.CI_REGISTRY_TOKEN }}" \
+          curl -s -H "Authorization: token ${{ secrets.REGISTRY_PUSH_TOKEN }}" \
             "https://gitea.niq-dev.com/api/v1/packages/gitea_admin/container/landing" \
             | jq -r '[.[] | select(.version | test("^[0-9a-f]{40}$"))] | sort_by(.created_at) | reverse | .[5:] | .[].id' \
             > /tmp/prune-ids.txt
@@ -49,6 +54,24 @@ jobs:
           while read -r id; do
             [ -z "$id" ] && continue
             echo "Deleting package version id=$id"
-            curl -s -X DELETE -H "Authorization: token ${{ secrets.CI_REGISTRY_TOKEN }}" \
+            curl -s -X DELETE -H "Authorization: token ${{ secrets.REGISTRY_PUSH_TOKEN }}" \
               "https://gitea.niq-dev.com/api/v1/packages/gitea_admin/container/landing/$id"
           done < /tmp/prune-ids.txt
+
+      - name: Update manifest with new image tag and commit back to git
+        # 讓 Argo CD 真正偵測到「有新版本要部署」：manifests/ 裡的
+        # image 從固定的 :latest 改成這次 build 的 commit-sha，
+        # Argo CD watch 到 git diff 才會觸發 sync（deployment.yaml
+        # 寫死 :latest 的話，即使 push 了新 image，K8s 也不會自動
+        # 重新 pull，Pod 會一直跑舊版本）。用 GIT_COMMIT_TOKEN（repo
+        # 寫入權限，跟 REGISTRY_PUSH_TOKEN 分開，最小權限原則）推回
+        # main。這次 push 只改 manifests/ 底下的檔案，會被上面
+        # paths-ignore 排除，不會再觸發一輪新的 build。
+        run: |
+          sed -i "s|landing:latest|landing:${{ gitea.sha }}|" manifests/deployment.yaml
+          git config user.name "gitea-actions"
+          git config user.email "actions@gitea.niq-dev.com"
+          git add manifests/deployment.yaml
+          git diff --cached --quiet && exit 0
+          git commit -m "Deploy landing:${{ gitea.sha }}"
+          git push "https://gitea_admin:${{ secrets.GIT_COMMIT_TOKEN }}@gitea.niq-dev.com/gitea_admin/landing.git" HEAD:main