diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 5ec4317e..51c880a2 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -443,16 +443,44 @@ jobs:
             git -C rdm submodule update --init --recursive
           done
           echo "RDM commit: $(git -C rdm rev-parse HEAD)"
+          # 凭据保留到构建循环内的 submodule update；make 经 without_creds
+          # 剥离，避免 token 进入构建进程。不写凭据文件、不把 token 放进命令行。
+          without_creds() {
+            env -u GIT_CONFIG_COUNT \
+              -u GIT_CONFIG_KEY_0 -u GIT_CONFIG_VALUE_0 \
+              -u GIT_CONFIG_KEY_1 -u GIT_CONFIG_VALUE_1 \
+              -u GIT_CONFIG_KEY_2 -u GIT_CONFIG_VALUE_2 \
+              -u GIT_CONFIG_KEY_3 -u GIT_CONFIG_VALUE_3 \
+              -u SUBMODULE_TOKEN \
+              "$@"
+          }
+          : > rdm/pin-build-digests.txt
+          for rev in "${pins[@]}"; do
+            git -C rdm checkout --detach "$rev"
+            git -C rdm submodule update --init --recursive
+            # 不能用「有无 go.mod」判定落地：pin 集合混有 Go 仓与非 Go 仓
+            #（例如前端仓根目录没有 go.mod）。真正要保证的是每个 pins/*
+            # gitlink 子模块 HEAD 等于记录的提交，且工作树已有已跟踪文件——
+            # 否则 Go 可能静默回退到远端解析。
+            while read -r mode _type gitlink path; do
+              [ "$mode" = "160000" ] || continue
+              head="$(git -C rdm -C "$path" rev-parse HEAD)"
+              if [ "$head" != "$gitlink" ]; then
+                echo "rdm pin ${rev} 的 ${path} 未落地：HEAD 不等于 gitlink 提交" >&2
+                exit 1
+              fi
+              if [ -z "$(git -C rdm -C "$path" ls-files)" ]; then
+                echo "rdm pin ${rev} 的 ${path} 未落地：工作树无已跟踪文件" >&2
+                exit 1
+              fi
+            done < <(git -C rdm ls-tree "$rev" pins/)
+            without_creds make -C rdm build
+            sha256sum rdm/bin/agent-system-rdm | awk -v rev="$rev" '{print rev, $1}' >> rdm/pin-build-digests.txt
+          done
           unset GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 \
                 GIT_CONFIG_KEY_1 GIT_CONFIG_VALUE_1 GIT_CONFIG_KEY_2 \
                 GIT_CONFIG_VALUE_2 GIT_CONFIG_KEY_3 GIT_CONFIG_VALUE_3
           unset SUBMODULE_TOKEN
-          : > rdm/pin-build-digests.txt
-          for rev in "${pins[@]}"; do
-            git -C rdm checkout --detach "$rev"
-            make -C rdm build
-            sha256sum rdm/bin/agent-system-rdm | awk -v rev="$rev" '{print rev, $1}' >> rdm/pin-build-digests.txt
-          done
       - name: Install Node 22
         run: |
           set -euo pipefail