diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index 045a81c..b0ef386 100644
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -48,9 +48,36 @@ jobs:
           print(\"dbbardata 600519 rows:\", n)
           exit(0 if n>0 else 1)'"
 
+  # ---------- 前端 build + 部署 NAS(与 nas-smoke 并行; VPS 无 web 不部署前端) ----------
+  nas-frontend:
+    needs: test
+    runs-on: macos-arm64
+    env:
+      HOME: /Users/chufeng
+    steps:
+      - name: checkout
+        env:
+          TOKEN: ${{ github.token }}
+        run: |
+          git init .
+          git config --local http.proxy ""
+          git config --local https.proxy ""
+          git remote add origin "http://oauth2:${TOKEN}@192.168.2.154:3000/${GITHUB_REPOSITORY}.git"
+          git fetch --depth 1 origin "${GITHUB_SHA}"
+          git checkout FETCH_HEAD
+      - name: build 前端 (node 在 /opt/homebrew/bin; npm ci 复用 HOME 的 ~/.npm cache)
+        run: |
+          export PATH="/opt/homebrew/bin:$PATH"
+          cd frontend
+          npm ci
+          npm run build
+      - name: 部署 dist 到 NAS (容器 bind mount homes/admin->/app; StaticFiles 实时读文件无需 restart)
+        run: |
+          rsync -az --delete frontend/dist/ sanguo-nas:/volume1/homes/admin/.sanguo_projects/sanguo_vnpy_v2/frontend/dist/
+
   # ---------- P3: VPS CD (prod gate) ----------
   vps:
-    needs: nas-smoke
+    needs: [nas-smoke, nas-frontend]
     runs-on: macos-arm64
     env:
       HOME: /Users/chufeng