diff --git a/.gitea/workflows/package.yml b/.gitea/workflows/package.yml
index e318c7a..55b1e93 100644
--- a/.gitea/workflows/package.yml
+++ b/.gitea/workflows/package.yml
@@ -88,7 +88,7 @@ jobs:
   docker-image:
     runs-on: ubuntu-22.04
     needs: validate
-    if: startsWith(github.ref, 'refs/tags/') || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'
+    if: startsWith(github.ref, 'refs/tags/')
     permissions:
       contents: read
     defaults:
@@ -143,14 +143,7 @@ jobs:
           REPOSITORY_PATH="${RAW_REPOSITORY#/}"
           IMAGE_REPOSITORY_PATH="$(printf '%s' "$REPOSITORY_PATH" | tr '[:upper:]' '[:lower:]')"
           IMAGE_NAME="${REGISTRY_HOST}/${IMAGE_REPOSITORY_PATH}"
-          case "$RAW_REF" in
-            refs/heads/main|refs/heads/master)
-              IMAGE_TAG="latest"
-              ;;
-            *)
-              IMAGE_TAG="${RAW_REF_NAME}"
-              ;;
-          esac
+          IMAGE_TAG="${RAW_REF_NAME}"
           {
             echo "REGISTRY_HOST=${REGISTRY_HOST}"
             echo "REPOSITORY_PATH=${REPOSITORY_PATH}"
diff --git a/README.md b/README.md
index 11804fb..c77e63e 100644
--- a/README.md
+++ b/README.md
@@ -248,7 +248,7 @@ docker compose down
 | `bun run start` | 直接运行 `src/server.ts` |
 | `bun run start:prod` | 先类型检查再启动 |
 | `bun run install:opencode` | 手动安装 `.opencode` 依赖 |
-| `bun run pipeline:trigger` | 通过强制更新远端 `main` 分支触发 Gitea CI/CD；分支触发时只发布/覆盖 `latest` 镜像 |
+| `bun run pipeline:trigger` | 通过重建并强推 annotated `latest` tag 触发 Gitea CI/CD，只发布/覆盖 `latest` 镜像 |
 
 ### 模型与 API 配置
 
diff --git a/scripts/trigger-gitea-pipeline.sh b/scripts/trigger-gitea-pipeline.sh
index f059591..f927fbd 100644
--- a/scripts/trigger-gitea-pipeline.sh
+++ b/scripts/trigger-gitea-pipeline.sh
@@ -3,12 +3,13 @@
 set -euo pipefail
 
 if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  echo "Usage: bash scripts/trigger-gitea-pipeline.sh [remote] [branch]"
+  echo "Usage: bash scripts/trigger-gitea-pipeline.sh [remote] [tag]"
   echo ""
   echo "Examples:"
   echo "  bash scripts/trigger-gitea-pipeline.sh"
-  echo "  bash scripts/trigger-gitea-pipeline.sh gitea main"
-  echo "  bash scripts/trigger-gitea-pipeline.sh origin main"
+  echo "  bash scripts/trigger-gitea-pipeline.sh gitea latest"
+  echo "  bash scripts/trigger-gitea-pipeline.sh origin latest"
+  echo "  bash scripts/trigger-gitea-pipeline.sh gitea v2026.05.19.1"
   exit 0
 fi
 
@@ -27,7 +28,7 @@ resolve_default_remote() {
 }
 
 REMOTE="${1:-}"
-BRANCH="${2:-main}"
+TAG="${2:-latest}"
 
 if ! git rev-parse --git-dir >/dev/null 2>&1; then
   echo "[ERROR] Current directory is not a git repository."
@@ -51,12 +52,16 @@ if ! git remote get-url "$REMOTE" >/dev/null 2>&1; then
 fi
 
 HEAD_SHA="$(git rev-parse --short HEAD)"
+MESSAGE="manual trigger: ${TAG} $(date '+%F %T')"
 
 echo "[INFO] HEAD: ${HEAD_SHA}"
-echo "[INFO] Force-push HEAD to remote branch '${BRANCH}'"
-git push "$REMOTE" "HEAD:refs/heads/${BRANCH}" --force
+echo "[INFO] Recreate annotated tag '${TAG}'"
+git tag -fa "$TAG" -m "$MESSAGE"
 
-echo "[INFO] Verify remote branch reference"
-git ls-remote "$REMOTE" "refs/heads/${BRANCH}"
+echo "[INFO] Push '${TAG}' to remote '${REMOTE}' (force update)"
+git push "$REMOTE" "refs/tags/${TAG}" --force
 
-echo "[DONE] Pipeline trigger request sent by updating branch '${BRANCH}'."
+echo "[INFO] Verify remote tag reference"
+git ls-remote --tags "$REMOTE" "refs/tags/${TAG}"
+
+echo "[DONE] Pipeline trigger request sent by updating tag '${TAG}'."