diff --git a/.gitea/workflows/secrets.yml b/.gitea/workflows/secrets.yml
index 503f081..23c606c 100644
--- a/.gitea/workflows/secrets.yml
+++ b/.gitea/workflows/secrets.yml
@@ -39,7 +39,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      # ── 版本检查（提前拦截，避免后续步骤白跑）──────────────────────────
+      # ── 版本解析 ────────────────────────────────────────────────────────
       - name: 解析版本
         id: ver
         run: |
@@ -49,11 +49,12 @@ jobs:
           echo "tag=${tag}" >> "$GITHUB_OUTPUT"
 
           if git rev-parse "refs/tags/${tag}" >/dev/null 2>&1; then
-            echo "错误: 版本 ${tag} 已存在，禁止重复发版。"
-            echo "请先 bump crates/secrets-mcp/Cargo.toml 中的 version，再执行 cargo build 同步 Cargo.lock。"
-            exit 1
+            echo "⚠ 版本 ${tag} 已存在，将覆盖重新发版。"
+            echo "tag_exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "将创建新版本 ${tag}"
+            echo "tag_exists=false" >> "$GITHUB_OUTPUT"
           fi
-          echo "将创建新版本 ${tag}"
 
       # ── Rust 工具链 ──────────────────────────────────────────────────────
       - name: 安装 Rust 与 musl 工具链
@@ -107,13 +108,18 @@ jobs:
           path: target/${{ env.MUSL_TARGET }}/release/${{ env.MCP_BINARY }}
           retention-days: 3
 
-      # ── 创建 Tag（构建成功后才打，避免留下指向失败提交的 tag）──────────
+      # ── 创建 / 覆盖 Tag（构建成功后才打）───────────────────────────────
       - name: 创建 Tag
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git tag -a "${{ steps.ver.outputs.tag }}" -m "Release ${{ steps.ver.outputs.tag }}"
-          git push origin "${{ steps.ver.outputs.tag }}"
+          tag="${{ steps.ver.outputs.tag }}"
+          if [ "${{ steps.ver.outputs.tag_exists }}" = "true" ]; then
+            git tag -d "$tag" 2>/dev/null || true
+            git push origin ":refs/tags/$tag" 2>/dev/null || true
+          fi
+          git tag -a "$tag" -m "Release $tag"
+          git push origin "$tag"
 
       # ── Release（可选，需配置 RELEASE_TOKEN）───────────────────────────
       - name: 创建并发布 Release
@@ -140,6 +146,19 @@ jobs:
             --arg body "$body" \
             '{tag_name: $tag, name: $name, body: $body, draft: false}')
 
+          # 若已存在同名 Release 则先删除（覆盖重发）
+          existing_code=$(curl -sS -o /tmp/existing-release.json -w '%{http_code}' \
+            -H "Authorization: token $RELEASE_TOKEN" \
+            "${release_api}/tags/${tag}")
+          if [ "$existing_code" = "200" ]; then
+            old_id=$(jq -r '.id // empty' /tmp/existing-release.json)
+            if [ -n "$old_id" ]; then
+              curl -sS -o /dev/null -H "Authorization: token $RELEASE_TOKEN" \
+                -X DELETE "${release_api}/${old_id}"
+              echo "已删除旧 Release: ${old_id}"
+            fi
+          fi
+
           http_code=$(curl -sS -o /tmp/release.json -w '%{http_code}' \
             -H "Authorization: token $RELEASE_TOKEN" \
             -H "Content-Type: application/json" \