diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 8eca7ea..5b5954c 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -86,6 +86,10 @@ jobs:
             kubectl apply -f /tmp/backend-deployment.yaml
             kubectl apply -f /tmp/web-deployment.yaml
             kubectl apply -f /tmp/ingress.yaml
+
+            # Preserve real client IP: disable SNAT on Traefik
+            kubectl patch svc traefik -n kube-system -p '{"spec":{"externalTrafficPolicy":"Local"}}' 2>/dev/null || true
+
             kubectl rollout restart deployment/video-backend
             kubectl rollout restart deployment/video-web
 
diff --git a/k8s/backend-deployment.yaml b/k8s/backend-deployment.yaml
index 5307e48..296a100 100644
--- a/k8s/backend-deployment.yaml
+++ b/k8s/backend-deployment.yaml
@@ -91,6 +91,8 @@ spec:
               key: ARK_API_KEY
         - name: SEEDANCE_ENABLED
           value: "true"
+        - name: ASSETS_API_ENABLED
+          value: "true"
         # Aliyun SMS
         - name: ALIYUN_SMS_ACCESS_KEY
           valueFrom: