diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 75102065..75cf1f02 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -765,4 +765,19 @@ jobs:
           # CI 无 SSH key：把受信基址与 URL 级 token 头经环境交给套件（仅环境传递）。
           export SVC_CI_GIT_SERVER="${GITHUB_SERVER_URL%/}"
           export SVC_CI_GIT_TOKEN="${SUBMODULE_TOKEN}"
+          # 套件经 SVC_RDM_SRC_DIR 物化嵌套 pins 时，RDM .gitmodules 的 SSH URL
+          # （新旧两形态）无凭据；按本 job Clone 步骤同源 insteadOf 改写到受信基址并带 token 头。
+          SERVER="$(printf '%s' "$GITHUB_SERVER_URL" | sed 's:/*$::')"
+          scheme="${GITHUB_SERVER_URL%%://*}"
+          export GIT_CONFIG_COUNT=5
+          export GIT_CONFIG_KEY_0="protocol.$scheme.allow"
+          export GIT_CONFIG_VALUE_0="always"
+          export GIT_CONFIG_KEY_1="http.$SERVER/.extraheader"
+          export GIT_CONFIG_VALUE_1="AUTHORIZATION: token $SUBMODULE_TOKEN"
+          export GIT_CONFIG_KEY_2="url.$SERVER/weichen/.insteadOf"
+          export GIT_CONFIG_VALUE_2="ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
+          export GIT_CONFIG_KEY_3="url.$SERVER/weichen/.insteadOf"
+          export GIT_CONFIG_VALUE_3="ssh://git@gitea.naitangbaobao.cn:52222/weichen/"
+          export GIT_CONFIG_KEY_4="core.hooksPath"
+          export GIT_CONFIG_VALUE_4="/dev/null"
           python3 -m unittest tests.test_svc_realcombo -v