diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 5ec4317e..884e2adf 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -443,16 +443,40 @@ jobs:
             git -C rdm submodule update --init --recursive
           done
           echo "RDM commit: $(git -C rdm rev-parse HEAD)"
+          # 构建循环每个 pin 都要重新物化自己的子模块，凭据环境保留到循环结束；
+          # make 经 env -u 剥离凭据变量运行，凭据只给 git 子模块更新使用。
+          without_creds() {
+            env -u GIT_CONFIG_COUNT -u GIT_CONFIG_KEY_0 -u GIT_CONFIG_VALUE_0 \
+                -u GIT_CONFIG_KEY_1 -u GIT_CONFIG_VALUE_1 -u GIT_CONFIG_KEY_2 \
+                -u GIT_CONFIG_VALUE_2 -u GIT_CONFIG_KEY_3 -u GIT_CONFIG_VALUE_3 \
+                -u SUBMODULE_TOKEN "$@"
+          }
+          : > rdm/pin-build-digests.txt
+          for rev in "${pins[@]}"; do
+            git -C rdm checkout --detach "$rev"
+            git -C rdm submodule update --init --recursive
+            # fail-loud：pins/* 本地 replace 目标缺失时 Go 会静默退回远端解析并报
+            # missing go.sum entry，因此构建前逐个核对 go.mod 与 gitlink。
+            links="$(git -C rdm ls-tree "$rev" pins/)"
+            while read -r mode _type commit path; do
+              [ "$mode" = "160000" ] || continue
+              if [ ! -f "rdm/$path/go.mod" ]; then
+                echo "rdm pin $rev 的 $path 未落地：缺少 go.mod" >&2
+                exit 1
+              fi
+              head="$(git -C rdm -C "$path" rev-parse HEAD 2>/dev/null || true)"
+              if [ "$head" != "$commit" ]; then
+                echo "rdm pin $rev 的 $path 未落地：HEAD ${head:-<none>} 与 gitlink $commit 不符" >&2
+                exit 1
+              fi
+            done <<< "$links"
+            without_creds make -C rdm build
+            sha256sum rdm/bin/agent-system-rdm | awk -v rev="$rev" '{print rev, $1}' >> rdm/pin-build-digests.txt
+          done
           unset GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 \
                 GIT_CONFIG_KEY_1 GIT_CONFIG_VALUE_1 GIT_CONFIG_KEY_2 \
                 GIT_CONFIG_VALUE_2 GIT_CONFIG_KEY_3 GIT_CONFIG_VALUE_3
           unset SUBMODULE_TOKEN
-          : > rdm/pin-build-digests.txt
-          for rev in "${pins[@]}"; do
-            git -C rdm checkout --detach "$rev"
-            make -C rdm build
-            sha256sum rdm/bin/agent-system-rdm | awk -v rev="$rev" '{print rev, $1}' >> rdm/pin-build-digests.txt
-          done
       - name: Install Node 22
         run: |
           set -euo pipefail