diff --git a/Jenkinsfile b/Jenkinsfile
index ca81d00..2c4b75b 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -59,9 +59,24 @@ pipeline {
           withCredentials([sshUserPrivateKey(credentialsId: 'PROD_SSH_KEY', keyFileVariable: 'SSH_KEY')]) {
             script {
               def imageName = "${ACR_REGISTRY}/${ACR_NAMESPACE}/${params.SERVICE}:${params.IMAGE_TAG}"
-              retry(3) {
+              def remoteCmd = """
+                set -e
+                # 清理悬空镜像，避免 containerd 存储损坏
+                docker image prune -f 2>/dev/null || true
+                # 拉取镜像（失败则清理后重试）
+                if ! docker pull ${imageName}; then
+                  echo 'Pull failed, cleaning containerd cache and retrying...'
+                  docker system prune -f
+                  docker pull ${imageName}
+                fi
+                # 部署
+                docker compose -f ${COMPOSE_FILE} up -d --no-deps --force-recreate ${params.SERVICE}
+                # 清理旧镜像
+                docker image prune -f
+              """.stripIndent()
+              retry(2) {
                 bat """
-                  ssh -i "%SSH_KEY%" -o StrictHostKeyChecking=no ${PROD_USER}@${PROD_HOST} "docker pull ${imageName} && docker compose -f ${COMPOSE_FILE} up -d --no-deps --force-recreate ${params.SERVICE} && docker image prune -f"
+                  ssh -i "%SSH_KEY%" -o StrictHostKeyChecking=no ${PROD_USER}@${PROD_HOST} "${remoteCmd}"
                 """
               }
             }