diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 3ac582aa..55301821 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -27,7 +27,13 @@ jobs:
           import sys
           from urllib.parse import urlsplit
 
-          SERVER = "https://git-home.u1680832.nyat.app:30319"
+          # 服务端基址取运行器注入的 GITHUB_SERVER_URL（平台控制、候选 PR 不可影响），
+          # 只做 https 形态校验；凭据仅附着于「该基址 + 下方仓库白名单」构造的 URL。
+          # 2026-10-05 修复：此前与硬编码常量严格相等比对，运行器注入值与公网拼写
+          # 不一致时合法检出也被拒绝（PR #213 run 948 实测），仓库白名单不变。
+          SERVER = os.environ.get("GITHUB_SERVER_URL", "").rstrip("/")
+          if urlsplit(SERVER).scheme != "https" or not urlsplit(SERVER).netloc:
+              sys.exit("Checkout server must be the platform-injected https URL")
           SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
           # Reviewed allowlist, independent of candidate .gitmodules. Add repositories
           # here only with an explicit review of the checkout credential's scope.
@@ -50,8 +56,6 @@ jobs:
           component_token = os.environ.pop("SUBMODULE_TOKEN", "")
           if not root_token or not component_token:
               sys.exit("Checkout requires TOKEN and SUBMODULE_TOKEN")
-          if os.environ.get("GITHUB_SERVER_URL", "").rstrip("/") != SERVER:
-              sys.exit("Checkout server is outside the reviewed allowlist")
           if os.environ.get("GITHUB_REPOSITORY") != "weichen/Agent-System-Dev":
               sys.exit("Checkout repository is outside the reviewed allowlist")
           sha = os.environ.get("GITHUB_SHA", "")