diff --git a/.env.example b/.env.example
index e837041..8bf193f 100644
--- a/.env.example
+++ b/.env.example
@@ -13,7 +13,9 @@
 
 # 当前部署版本号，格式：YYYY.MM.DD-private.N
 # 用于镜像标签匹配和审计追溯
-PRIVATE_VERSION=2026.05.18-private.1
+PRIVATE_VERSION=2026.05.21-private.2
+# 安装目录的绝对路径（deploy.sh 自动写入，用于容器内一键更新功能）
+PRIVATE_DEPLOY_ROOT=/opt/xuqm-private
 
 # =============================================================================
 # 镜像仓库
diff --git a/docker-compose.yml b/docker-compose.yml
index 056d4da..5c06462 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -32,6 +32,11 @@ services:
       SPRING_DATA_REDIS_HOST: "${REDIS_HOST}"
       SPRING_DATA_REDIS_PORT: "${REDIS_PORT:-6379}"
       SPRING_DATA_REDIS_DATABASE: "${REDIS_DATABASE:-0}"
+      # 一键更新功能所需：部署根目录（容器内与宿主机路径相同）
+      PRIVATE_DEPLOY_ROOT: "${PRIVATE_DEPLOY_ROOT:-/opt/xuqm-private}"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ${PRIVATE_DEPLOY_ROOT:-/opt/xuqm-private}:${PRIVATE_DEPLOY_ROOT:-/opt/xuqm-private}:ro
     restart: unless-stopped
 
   # ---------------------------------------------------------------------------
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 6ca2798..d0be626 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -266,7 +266,8 @@ cat > "$ROOT_DIR/.env" <<EOF
 # 部署主机: ${DEPLOY_HOST}
 # =============================================================================
 
-PRIVATE_VERSION=2026.05.19-private.1
+PRIVATE_VERSION=2026.05.21-private.2
+PRIVATE_DEPLOY_ROOT=${ROOT_DIR}
 REGISTRY=${REGISTRY}
 REGISTRY_USER=${REGISTRY_USER}
 REGISTRY_PASSWORD=${REGISTRY_PASSWORD}
diff --git a/scripts/update.sh b/scripts/update.sh
index 8720c71..ace3f0a 100755
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -119,6 +119,12 @@ if ! grep -q "^SPRING_DATA_REDIS_PASSWORD=" "$ROOT_DIR/config/secrets.env" 2>/de
 fi
 [ "$_patched" -eq 1 ] && ok "secrets.env 已补齐 SPRING_DATASOURCE_PASSWORD / SPRING_DATA_REDIS_PASSWORD"
 
+# 迁移：补齐 PRIVATE_DEPLOY_ROOT（一键更新功能需要此变量，旧版部署升级时自动写入）
+if ! grep -q "^PRIVATE_DEPLOY_ROOT=" "$ROOT_DIR/.env" 2>/dev/null; then
+  printf '\nPRIVATE_DEPLOY_ROOT=%s\n' "$ROOT_DIR" >> "$ROOT_DIR/.env"
+  ok ".env 已补齐 PRIVATE_DEPLOY_ROOT=$ROOT_DIR"
+fi
+
 _CONSOLE_DOMAIN="$(grep '^CONSOLE_DOMAIN=' "$ROOT_DIR/config/xuqm.env" 2>/dev/null \
   | cut -d= -f2- | tr -d '"' | tr -d "'")"
 _NGINX_BIND="${NGINX_BIND:-80}"