diff --git a/.github/workflows/deploy-to-cn-server.yml b/.github/workflows/deploy-to-cn-server.yml
index bbd1dd62..bf8d387f 100644
--- a/.github/workflows/deploy-to-cn-server.yml
+++ b/.github/workflows/deploy-to-cn-server.yml
@@ -26,6 +26,9 @@ on:
           - init
           - health-check
 
+env:
+  CN_DEFAULT_PATH: /opt/zhuyuan-cn
+
 concurrency:
   group: cn-server-deploy
   cancel-in-progress: false
@@ -76,7 +79,8 @@ jobs:
 
       - name: 📦 同步应用代码
         run: |
-          CN_PATH="${{ secrets.ZY_CN_SERVER_PATH || '/opt/zhuyuan-cn' }}"
+          CN_PATH="${{ secrets.ZY_CN_SERVER_PATH }}"
+          CN_PATH="${CN_PATH:-${{ env.CN_DEFAULT_PATH }}}"
           echo "📦 部署目标: ${CN_PATH}"
 
           # 确保目标目录存在
@@ -91,7 +95,8 @@ jobs:
 
       - name: 📦 同步大脑文件
         run: |
-          CN_PATH="${{ secrets.ZY_CN_SERVER_PATH || '/opt/zhuyuan-cn' }}"
+          CN_PATH="${{ secrets.ZY_CN_SERVER_PATH }}"
+          CN_PATH="${CN_PATH:-${{ env.CN_DEFAULT_PATH }}}"
 
           # 同步大脑核心文件到备用服务器
           rsync -avz \
@@ -101,7 +106,8 @@ jobs:
 
       - name: 📥 安装依赖 & 重启
         run: |
-          CN_PATH="${{ secrets.ZY_CN_SERVER_PATH || '/opt/zhuyuan-cn' }}"
+          CN_PATH="${{ secrets.ZY_CN_SERVER_PATH }}"
+          CN_PATH="${CN_PATH:-${{ env.CN_DEFAULT_PATH }}}"
           COMMIT_SHA="${{ github.sha }}"
           ssh -i ~/.ssh/zy_cn_key \
             ${{ secrets.ZY_CN_SERVER_USER }}@${{ secrets.ZY_CN_SERVER_HOST }} << DEPLOY_CMD
@@ -109,6 +115,12 @@ jobs:
           set -e
           cd ${CN_PATH}/app
 
+          # 验证入口文件存在
+          if [ ! -f server.js ]; then
+            echo "❌ 错误: server.js 不存在"
+            exit 1
+          fi
+
           # 安装依赖
           npm install --production 2>&1
 
diff --git a/server/setup/cn-server-init.sh b/server/setup/cn-server-init.sh
index 9ecb38cd..2c7b03fd 100644
--- a/server/setup/cn-server-init.sh
+++ b/server/setup/cn-server-init.sh
@@ -200,13 +200,9 @@ log "  自动安全更新已启用"
 
 # ═══ §9 SSH安全加固 ═══
 log "§9 SSH安全加固..."
-if grep -q "^PasswordAuthentication yes" /etc/ssh/sshd_config 2>/dev/null; then
-  sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
-  systemctl restart sshd
-  log "  密码登录已禁用，仅允许密钥认证"
-else
-  log "  SSH配置已安全，跳过"
-fi
+sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
+systemctl restart sshd
+log "  密码登录已禁用，仅允许密钥认证"
 
 # ═══ §10 完成报告 ═══
 log "§10 生成初始化报告..."