diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 971f0f2..da06626 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -37,8 +37,24 @@ jobs:
       - run: uv run python manage.py makemigrations --check --dry-run
       - run: uv run pytest --cov=finance --cov-report=term-missing --cov-fail-under=85
       - run: npm run build
-      - run: npm audit --omit=dev --registry=https://registry.npmjs.org
-      - run: uv run pip-audit
+      # 审计端点在 runner 网络下偶发 TLS 断开（npm error audit endpoint returned
+      # an error），重试区分网络抖动与真实漏洞：漏洞是确定性的，重试后照样红。
+      - name: npm audit (production deps)
+        run: |
+          for attempt in 1 2 3; do
+            npm audit --omit=dev --registry=https://registry.npmjs.org && exit 0
+            echo "::warning::npm audit 第 ${attempt} 次失败，15 秒后重试"
+            sleep 15
+          done
+          exit 1
+      - name: pip-audit
+        run: |
+          for attempt in 1 2 3; do
+            uv run pip-audit && exit 0
+            echo "::warning::pip-audit 第 ${attempt} 次失败，15 秒后重试"
+            sleep 15
+          done
+          exit 1
       - run: uv run python manage.py migrate --noinput
       - run: uv run python manage.py collectstatic --noinput
       - run: uv run python manage.py bootstrap --username admin --organization CI