diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 4798606..016e399 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -297,6 +297,22 @@ for port in "$_NGINX_PORT"; do
   fi
 done
 
+# 自动检测内部服务端口冲突（WSL2/多套部署场景下 11224-11231 可能被宿主机占用）
+_SVC_PORT_OFFSET=0
+if ss -tlnp 2>/dev/null | grep -qE ':(11224|11225|11226|11228|11229|11230|11231) '; then
+  warn "检测到内部服务端口（11224-11231）已被占用，自动使用偏移 +10000（21224-21231）"
+  _SVC_PORT_OFFSET=10000
+fi
+SVC_PORT_TENANT=$((11224 + _SVC_PORT_OFFSET))
+SVC_PORT_FILE=$((11225 + _SVC_PORT_OFFSET))
+SVC_PORT_WEB=$((11226 + _SVC_PORT_OFFSET))
+SVC_PORT_IM=$((11228 + _SVC_PORT_OFFSET))
+SVC_PORT_PUSH=$((11229 + _SVC_PORT_OFFSET))
+SVC_PORT_UPDATE=$((11230 + _SVC_PORT_OFFSET))
+SVC_PORT_LICENSE=$((11231 + _SVC_PORT_OFFSET))
+[ "$_SVC_PORT_OFFSET" -eq 0 ] && ok "内部服务端口段 11224-11231 空闲" || \
+  ok "内部服务端口段自动调整为 21224-21231"
+
 # ---------------------------------------------------------------------------
 # Step 2 — 写入配置
 # ---------------------------------------------------------------------------
@@ -354,6 +370,15 @@ ENABLE_LICENSE=true
 
 TENANT_BOOTSTRAP_EMAIL=${DEPLOY_TENANT_EMAIL}
 TENANT_BOOTSTRAP_APP_KEY=ak_private_default
+
+# 内部服务宿主机端口绑定（自动偏移后的值，默认 11224-11231）
+SVC_PORT_TENANT=${SVC_PORT_TENANT}
+SVC_PORT_FILE=${SVC_PORT_FILE}
+SVC_PORT_WEB=${SVC_PORT_WEB}
+SVC_PORT_IM=${SVC_PORT_IM}
+SVC_PORT_PUSH=${SVC_PORT_PUSH}
+SVC_PORT_UPDATE=${SVC_PORT_UPDATE}
+SVC_PORT_LICENSE=${SVC_PORT_LICENSE}
 EOF
 ok ".env 已写入"
 
@@ -594,7 +619,7 @@ docker compose \
 printf '  等待 tenant-service 启动'
 for i in $(seq 1 40); do
   code="$(curl -skL --noproxy '*' -o /dev/null -w '%{http_code}' --max-time 4 \
-    "http://127.0.0.1:11224/actuator/health" 2>/dev/null || echo 000)"
+    "http://127.0.0.1:${SVC_PORT_TENANT}/actuator/health" 2>/dev/null || echo 000)"
   if [ "$code" = "200" ]; then
     printf '\n'
     ok "tenant-service 健康 (HTTP 200)"
@@ -777,7 +802,7 @@ print(json.dumps(resp['data']))
     -H "Content-Type: application/json" \
     --data-binary @- \
     -w "\n__HTTP_STATUS__:%{http_code}" \
-    "http://127.0.0.1:11224/api/private/deployment/migrate/import")
+    "http://127.0.0.1:${SVC_PORT_TENANT}/api/private/deployment/migrate/import")
   _IMPORT_STATUS=$(printf '%s' "$_IMPORT_RESP" | grep -o '__HTTP_STATUS__:[0-9]*' | cut -d: -f2)
   _IMPORT_BODY=$(printf '%s' "$_IMPORT_RESP" | sed 's/__HTTP_STATUS__:[0-9]*//')
   if [ "${_IMPORT_STATUS}" != "200" ]; then