diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index cb46d8c..c8241f0 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -38,6 +38,7 @@ jobs:
           for attempt in 1 2 3; do
             echo "Build web attempt $attempt/3..."
             DOCKER_BUILDKIT=0 docker build \
+              --build-arg NEXT_PUBLIC_TOS_DOMAIN=https://cyber-star.tos-cn-shanghai.volces.com \
               --tag ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/cyberstar-web:${{ env.IMAGE_TAG }} \
               --tag ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/cyberstar-web:latest \
               . 2>&1 | tee /tmp/build.log && break
diff --git a/Dockerfile b/Dockerfile
index 4e66181..2f595ba 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -28,6 +28,10 @@ RUN corepack enable && corepack prepare pnpm@latest --activate
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
 
+# Build-time public env：NEXT_PUBLIC_* 必须在 next build 之前注入,
+# 否则会被烧成空字符串,运行时再设也无效 (Next.js 把这类 env 编译进 client bundle)
+ARG NEXT_PUBLIC_TOS_DOMAIN
+ENV NEXT_PUBLIC_TOS_DOMAIN=${NEXT_PUBLIC_TOS_DOMAIN}
 ENV NEXT_TELEMETRY_DISABLED=1
 # COPY . . 会覆盖 prisma/schema 的最新版本，需要再 generate 一次确保 client 同步
 RUN pnpm exec prisma generate \