diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 65ab3400..d4e38e4b 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -92,7 +92,11 @@ jobs:
       continue-on-error: true
       run: |
         git fetch origin main
+        # stash任何未提交的更改，避免rebase失败
+        git stash push -m "temp stash for rebase"
         git rebase origin/main
+        # 恢复stash的更改
+        git stash pop || true
         if ! git log --oneline -1 | grep -q "\[skip ci\]"; then
           echo "No auto-commits to push"
         else
diff --git a/.github/workflows/subset-fonts.yml b/.github/workflows/subset-fonts.yml
index 4872d3c0..65f3fcfb 100644
--- a/.github/workflows/subset-fonts.yml
+++ b/.github/workflows/subset-fonts.yml
@@ -35,6 +35,8 @@ jobs:
     name: Subset Fonts
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions:
+      contents: write  # 添加写权限
 
     # 只在主仓库上运行（fork不运行）
     if: github.repository == 'zqlit/blog'