diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 646a9cc..d91bb54 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -16,6 +16,10 @@ jobs:
 
       - name: Set environment by branch
         run: |
+          # 版本标签：commit 短哈希
+          SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
+          echo "IMAGE_TAG=${SHORT_SHA}" >> $GITHUB_ENV
+
           if [[ "${{ github.ref_name }}" == "master" ]]; then
             echo "CR_ORG=prod" >> $GITHUB_ENV
             echo "DEPLOY_ENV=production" >> $GITHUB_ENV
@@ -38,9 +42,11 @@ jobs:
         run: |
           set -o pipefail
           DOCKER_BUILDKIT=0 docker build \
+            --tag ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/log-center-api:${{ env.IMAGE_TAG }} \
             --tag ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/log-center-api:latest \
             -f ./Dockerfile \
             . 2>&1 | tee /tmp/build-api.log
+          docker push ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/log-center-api:${{ env.IMAGE_TAG }} 2>&1 | tee -a /tmp/build-api.log
           docker push ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/log-center-api:latest 2>&1 | tee -a /tmp/build-api.log
 
       # Build Web Image
@@ -50,9 +56,11 @@ jobs:
           set -o pipefail
           DOCKER_BUILDKIT=0 docker build \
             --build-arg VITE_API_BASE_URL=https://${{ env.DOMAIN_API }} \
+            --tag ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/log-center-web:${{ env.IMAGE_TAG }} \
             --tag ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/log-center-web:latest \
             -f ./web/Dockerfile \
             ./web 2>&1 | tee /tmp/build-web.log
+          docker push ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/log-center-web:${{ env.IMAGE_TAG }} 2>&1 | tee -a /tmp/build-web.log
           docker push ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/log-center-web:latest 2>&1 | tee -a /tmp/build-web.log
 
       # Build K8s Monitor Image
@@ -61,9 +69,11 @@ jobs:
         run: |
           set -o pipefail
           DOCKER_BUILDKIT=0 docker build \
+            --tag ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/k8s-pod-monitor:${{ env.IMAGE_TAG }} \
             --tag ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/k8s-pod-monitor:latest \
             -f ./k8s-monitor/Dockerfile \
             ./k8s-monitor 2>&1 | tee /tmp/build-monitor.log
+          docker push ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/k8s-pod-monitor:${{ env.IMAGE_TAG }} 2>&1 | tee -a /tmp/build-monitor.log
           docker push ${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/k8s-pod-monitor:latest 2>&1 | tee -a /tmp/build-monitor.log
 
       - name: Setup Kubectl
@@ -86,10 +96,10 @@ jobs:
           echo "API Domain: ${{ env.DOMAIN_API }}"
           echo "Web Domain: ${{ env.DOMAIN_WEB }}"
 
-          # Replace image placeholders
-          sed -i "s|\${CI_REGISTRY_IMAGE}/log-center-api:latest|${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/log-center-api:latest|g" k8s/api-deployment-prod.yaml
-          sed -i "s|\${CI_REGISTRY_IMAGE}/log-center-web:latest|${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/log-center-web:latest|g" k8s/web-deployment-prod.yaml
-          sed -i "s|\${CI_REGISTRY_IMAGE}/k8s-pod-monitor:latest|${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/k8s-pod-monitor:latest|g" k8s/monitor-cronjob.yaml
+          # Replace image placeholders with versioned tag
+          sed -i "s|\${CI_REGISTRY_IMAGE}/log-center-api:latest|${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/log-center-api:${{ env.IMAGE_TAG }}|g" k8s/api-deployment-prod.yaml
+          sed -i "s|\${CI_REGISTRY_IMAGE}/log-center-web:latest|${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/log-center-web:${{ env.IMAGE_TAG }}|g" k8s/web-deployment-prod.yaml
+          sed -i "s|\${CI_REGISTRY_IMAGE}/k8s-pod-monitor:latest|${{ secrets.CR_SERVER }}/${{ env.CR_ORG }}/k8s-pod-monitor:${{ env.IMAGE_TAG }}|g" k8s/monitor-cronjob.yaml
 
           # Replace domain placeholders in ingress
           sed -i "s|qiyuan-log-center-api.airlabs.art|${{ env.DOMAIN_API }}|g" k8s/ingress.yaml