diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 37b25a61..621fdad8 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -409,12 +409,12 @@ jobs:
           make -C rdm build
       - name: Real-combination identity gates over real PostgreSQL (U3, required)
         env:
-          SVC_TEST_REAL: "1"
-          SVC_TEST_PG: "1"
-          SVC_REAL_RDM_BIN: $PWD/rdm/bin/agent-system-rdm
           AGENT_PG_TEST_DSN: postgres://ci_agent:ci_job_local_only@127.0.0.1:5432/agent_test?sslmode=disable
         run: |
           set -euo pipefail
+          # 路径变量在脚本内解析（YAML env: 不做 shell 展开）。
+          export SVC_TEST_REAL=1 SVC_TEST_PG=1
+          export SVC_REAL_RDM_BIN="$PWD/rdm/bin/agent-system-rdm"
           python3 -m unittest tests.test_svc_realcombo -v
 
   # U3（统一部署方案）：真实 Dev/RDM 制品的 svc.sh 生命周期门禁——桩套件
@@ -616,11 +616,11 @@ jobs:
           unset SUBMODULE_TOKEN
           make -C rdm build
       - name: Run real-combination lifecycle gates (SQLite, U3, required)
-        env:
-          SVC_TEST_REAL: "1"
-          SVC_REAL_BIN: $PWD/bin/agent-system
-          SVC_REAL_RDM_BIN: $PWD/rdm/bin/agent-system-rdm
-          SVC_RDM_ORIGIN: $PWD/rdm
         run: |
           set -euo pipefail
+          # 路径变量在脚本内解析（YAML env: 不做 shell 展开）。
+          export SVC_TEST_REAL=1
+          export SVC_REAL_BIN="$PWD/bin/agent-system"
+          export SVC_REAL_RDM_BIN="$PWD/rdm/bin/agent-system-rdm"
+          export SVC_RDM_ORIGIN="$PWD/rdm"
           python3 -m unittest tests.test_svc_realcombo -v