diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 731204ca..37b25a61 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -398,12 +398,14 @@ jobs:
           export GIT_CONFIG_KEY_3="core.hooksPath"
           export GIT_CONFIG_VALUE_3="/dev/null"
           git clone --depth=1 "$SERVER/weichen/Agent-System-RDM.git" rdm
+          # 凭据环境须保持到 pins 子模块取完（insteadOf + token 头覆盖嵌套 SSH URL），
+          # 之后再 unset。
+          git -C rdm submodule update --init --recursive
+          echo "RDM commit: $(git -C rdm rev-parse HEAD)"
           unset GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 \
                 GIT_CONFIG_KEY_1 GIT_CONFIG_VALUE_1 GIT_CONFIG_KEY_2 \
                 GIT_CONFIG_VALUE_2 GIT_CONFIG_KEY_3 GIT_CONFIG_VALUE_3
           unset SUBMODULE_TOKEN
-          git -C rdm submodule update --init --recursive
-          echo "RDM commit: $(git -C rdm rev-parse HEAD)"
           make -C rdm build
       - name: Real-combination identity gates over real PostgreSQL (U3, required)
         env:
@@ -604,12 +606,14 @@ jobs:
           export GIT_CONFIG_KEY_3="core.hooksPath"
           export GIT_CONFIG_VALUE_3="/dev/null"
           git clone --depth=1 "$SERVER/weichen/Agent-System-RDM.git" rdm
+          # 凭据环境须保持到 pins 子模块取完（insteadOf + token 头覆盖嵌套 SSH URL），
+          # 之后再 unset。
+          git -C rdm submodule update --init --recursive
+          echo "RDM commit: $(git -C rdm rev-parse HEAD)"
           unset GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 \
                 GIT_CONFIG_KEY_1 GIT_CONFIG_VALUE_1 GIT_CONFIG_KEY_2 \
                 GIT_CONFIG_VALUE_2 GIT_CONFIG_KEY_3 GIT_CONFIG_VALUE_3
           unset SUBMODULE_TOKEN
-          git -C rdm submodule update --init --recursive
-          echo "RDM commit: $(git -C rdm rev-parse HEAD)"
           make -C rdm build
       - name: Run real-combination lifecycle gates (SQLite, U3, required)
         env: