diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 662c7b3f..4c2d8162 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -264,15 +264,9 @@ jobs:
         echo "📤 更新 hash 文件到腾讯云 COS..."
         coscmd upload public/.build_hash /__build_hash
 
-    - name: Cache upx
-      uses: actions/cache@v4
-      id: upx-cache
-      with:
-        path: /tmp/upyun-upx
-        key: upx-0.4.9
-        
     - name: Upload to UpYun
       if: steps.check-upload.outputs.need_upload == 'true'
+      timeout-minutes: 10
       env:
         UPYUN_SERVICE: ${{ secrets.UPYUN_BUCKET }}
         UPYUN_OPERATOR: ${{ secrets.UPYUN_OPERATOR }}
@@ -281,21 +275,40 @@ jobs:
       continue-on-error: true
       run: |
         echo "📤 上传构建产物到 UpYun..."
-        
+
         UPX_VERSION="0.4.9"
-        UPX_URL="https://collection.b0.upaiyun.com/softwares/upx/upx_${UPX_VERSION}_linux_amd64.tar.gz"
         UPX_BIN="/tmp/upyun-upx"
-        
+
+        # 主源用 GitHub Releases（实测 0.5s 稳定），
+        # 官方 collection.b0.upaiyun.com 实测 2/3 概率整站无响应，仅作兜底
+        UPX_URLS=(
+          "https://github.com/upyun/upx/releases/download/v${UPX_VERSION}/upx_${UPX_VERSION}_linux_amd64.tar.gz"
+          "https://collection.b0.upaiyun.com/softwares/upx/upx_${UPX_VERSION}_linux_amd64.tar.gz"
+        )
+
         if [ ! -x "$UPX_BIN" ]; then
-          curl -sL "$UPX_URL" -o /tmp/upx.tar.gz
-          tar -xzf /tmp/upx.tar.gz -C /tmp
-          mv /tmp/upx "$UPX_BIN"
-          chmod +x "$UPX_BIN"
+          ok=false
+          for U in "${UPX_URLS[@]}"; do
+            echo "⬇️  下载 upx: $U"
+            if curl -fsSL --connect-timeout 10 --max-time 60 --retry 2 --retry-delay 2 \
+                 -o /tmp/upx.tar.gz "$U"; then
+              if tar -xzf /tmp/upx.tar.gz -C /tmp && [ -f /tmp/upx ]; then
+                mv /tmp/upx "$UPX_BIN" && chmod +x "$UPX_BIN" && ok=true
+                echo "✅ upx 就绪: $("$UPX_BIN" --version 2>&1 | head -1)"
+                break
+              fi
+            fi
+            echo "⚠️  该源失败，尝试下一个..."
+          done
+          if [ "$ok" != "true" ]; then
+            echo "❌ 所有 upx 下载源均失败，跳过 UpYun 上传"
+            exit 1
+          fi
         fi
-        
+
         for i in 1 2 3 4 5; do
           echo "🔐 UpYun 登录 (尝试 $i/5)..."
-          if "$UPX_BIN" login "$UPYUN_SERVICE" "$UPYUN_OPERATOR" "$UPYUN_PASSWORD" 2>&1; then
+          if timeout 30 "$UPX_BIN" login "$UPYUN_SERVICE" "$UPYUN_OPERATOR" "$UPYUN_PASSWORD" 2>&1; then
             echo "✅ 登录成功"
             break
           else
@@ -303,10 +316,10 @@ jobs:
             sleep 10
           fi
         done
-        
+
         echo "🔄 开始上传到 UpYun..."
-        "$UPX_BIN" sync public/ / -w 10 --delete --strong
-        "$UPX_BIN" put public/.build_hash /__build_hash
+        timeout 480 "$UPX_BIN" sync public/ / -w 10 --delete --strong
+        timeout 30 "$UPX_BIN" put public/.build_hash /__build_hash
         echo "✅ UpYun 上传完成"
         echo "skipped=false" >> $GITHUB_OUTPUT