diff --git a/.gitea/workflows/promote-prod.yml b/.gitea/workflows/promote-prod.yml
index 86e958f..45fdb41 100644
--- a/.gitea/workflows/promote-prod.yml
+++ b/.gitea/workflows/promote-prod.yml
@@ -22,6 +22,10 @@ env:
 jobs:
   promote-prod:
     runs-on: ubuntu-latest
+    # job 级 env: shell 变量不跨 step, 必须在这里声明才能在所有 step 中使用
+    env:
+      TEST: ${{ secrets.CAPTCHA_TEST_HOST }}
+      PROD: ${{ secrets.CAPTCHA_PROD_HOST }}
     if: github.event.inputs.confirm == 'yes'
     steps:
       - name: Setup SSH key (from secrets)
@@ -37,7 +41,6 @@ jobs:
         run: |
           set -e
           SSH_KEY="$HOME/.ssh/id_ed25519_deploy"
-          TEST=${{ secrets.CAPTCHA_TEST_HOST }}
           ssh -i $SSH_KEY root@$TEST \
             "docker pull $IMAGE:test >/dev/null && docker save $IMAGE:test | gzip > /tmp/tianai-promote.tar.gz && ls -la /tmp/tianai-promote.tar.gz"
           scp -i $SSH_KEY root@$TEST:/tmp/tianai-promote.tar.gz /tmp/tianai-promote.tar.gz
@@ -47,7 +50,6 @@ jobs:
         run: |
           set -e
           SSH_KEY="$HOME/.ssh/id_ed25519_deploy"
-          PROD=${{ secrets.CAPTCHA_PROD_HOST }}
           scp -i $SSH_KEY /tmp/tianai-promote.tar.gz root@$PROD:/tmp/
           ssh -i $SSH_KEY root@$TEST 'rm -f /tmp/tianai-promote.tar.gz'
           rm -f /tmp/tianai-promote.tar.gz
@@ -57,7 +59,6 @@ jobs:
         run: |
           set -e
           SSH_KEY="$HOME/.ssh/id_ed25519_deploy"
-          PROD=${{ secrets.CAPTCHA_PROD_HOST }}
           ssh -i $SSH_KEY root@$PROD '
             set -e
             echo "===== 备份当前生产镜像 ====="
@@ -86,7 +87,6 @@ jobs:
         run: |
           set -e
           SSH_KEY="$HOME/.ssh/id_ed25519_deploy"
-          PROD=${{ secrets.CAPTCHA_PROD_HOST }}
           OK=0
           CODE=000
           for i in $(seq 1 24); do