diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 8da785d..cea451a 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -48,6 +48,7 @@ jobs:
 
       - name: Deploy to both servers
         run: |
+          set -euo pipefail
           deploy_to() {
             local HOST=$1
             echo ">>> 部署到 $HOST"
@@ -58,25 +59,37 @@ jobs:
             echo ">>> $HOST 部署完成"
           }
           deploy_to "${{ secrets.FRONTEND_1_HOST }}" &
+          PID1=$!
           deploy_to "${{ secrets.FRONTEND_2_HOST }}" &
-          wait
+          PID2=$!
+          FAIL=0
+          wait $PID1 || { echo "ERROR: frontend-1 部署失败"; FAIL=1; }
+          wait $PID2 || { echo "ERROR: frontend-2 部署失败"; FAIL=1; }
+          [ $FAIL -eq 0 ] || exit 1
           echo "=== 两台都部署完成 ==="
 
-      - name: Verify both servers match
+      - name: Verify both servers match local build
         run: |
+          set -euo pipefail
+          LOCAL=$(sha256sum dist/index.html | awk '{print $1}')
           SUM1=$(ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no \
             ec2-user@${{ secrets.FRONTEND_1_HOST }} \
             "sha256sum /var/www/ark-library/index.html | awk '{print \$1}'")
           SUM2=$(ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no \
             ec2-user@${{ secrets.FRONTEND_2_HOST }} \
             "sha256sum /var/www/ark-library/index.html | awk '{print \$1}'")
+          echo "local:      $LOCAL"
           echo "frontend-1: $SUM1"
           echo "frontend-2: $SUM2"
-          if [ "$SUM1" != "$SUM2" ]; then
-            echo "ERROR: 两台 index.html 不一样！"
+          if [ "$SUM1" != "$LOCAL" ]; then
+            echo "ERROR: frontend-1 不是本次构建的版本"
             exit 1
           fi
-          echo "✓ 两台 checksum 一致，部署成功。"
+          if [ "$SUM2" != "$LOCAL" ]; then
+            echo "ERROR: frontend-2 不是本次构建的版本"
+            exit 1
+          fi
+          echo "✓ 两台都已经更新到本次构建的版本。"
 
       - name: Cleanup SSH key
         if: always()