diff --git a/Jenkinsfile b/Jenkinsfile
index b906b57..31869a9 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -148,14 +148,16 @@ print('versions.json updated: ${svcName}=${svcVer}')
 
     stage('Commit Version') {
       steps {
-        bat """
-          chcp 65001 >nul
-          git config user.email "jenkins@xuqm.com"
-          git config user.name "Jenkins CI"
-          git add ${env.VERSION_FILE}
-          git diff --cached --quiet || git commit -m "ci: bump ${env.IMAGE_NAME} to ${env.SERVICE_VERSION} [skip ci]"
-          git push origin HEAD:main
-        """
+        sshagent(credentials: ['jenkins-ssh-key']) {
+          bat """
+            chcp 65001 >nul
+            git config user.email "jenkins@xuqm.com"
+            git config user.name "Jenkins CI"
+            git add ${env.VERSION_FILE}
+            git diff --cached --quiet || git commit -m "ci: bump ${env.IMAGE_NAME} to ${env.SERVICE_VERSION} [skip ci]"
+            git push origin HEAD:main
+          """
+        }
       }
     }
   }
diff --git a/Jenkinsfile.ops-web b/Jenkinsfile.ops-web
index 2f871cc..0a160b6 100644
--- a/Jenkinsfile.ops-web
+++ b/Jenkinsfile.ops-web
@@ -110,14 +110,16 @@ print('versions.json updated: ${env.DEPLOY_SERVICE} = ${env.IMAGE_VERSION}')
 
     stage('Commit Version') {
       steps {
-        script {
-          bat """
-            git config user.email "jenkins@xuqm.com"
-            git config user.name "Jenkins CI"
-            git add ${env.VERSION_FILE}
-            git diff --cached --quiet || git commit -m "ci: bump ${env.IMAGE_NAME} to ${env.IMAGE_VERSION} [skip ci]"
-            git push origin HEAD:main
-          """
+        sshagent(credentials: ['jenkins-ssh-key']) {
+          script {
+            bat """
+              git config user.email "jenkins@xuqm.com"
+              git config user.name "Jenkins CI"
+              git add ${env.VERSION_FILE}
+              git diff --cached --quiet || git commit -m "ci: bump ${env.IMAGE_NAME} to ${env.IMAGE_VERSION} [skip ci]"
+              git push origin HEAD:main
+            """
+          }
         }
       }
     }
diff --git a/Jenkinsfile.tenant-web b/Jenkinsfile.tenant-web
index fb3c34f..91a6ea6 100644
--- a/Jenkinsfile.tenant-web
+++ b/Jenkinsfile.tenant-web
@@ -39,8 +39,8 @@ pipeline {
           branches: [[name: 'main']],
           extensions: [[$class: 'CleanBeforeCheckout']],
           userRemoteConfigs: [[
-            url: 'https://xuqinmin.com/xuqmGroup/XuqmGroup-Web.git',
-            credentialsId: 'XUQM_GIT_CREDENTIALS'
+            url: 'ssh://git@xuqinmin.com:2222/xuqmGroup/XuqmGroup-Web.git',
+            credentialsId: 'jenkins-ssh-key'
           ]]
         ])
       }
@@ -142,14 +142,16 @@ print('versions.json updated: ${env.DEPLOY_SERVICE} = ${env.IMAGE_VERSION}')
     stage('Commit Version') {
       when { expression { params.DEPLOY_ENV == 'production' } }
       steps {
-        script {
-          bat """
-            git config user.email "jenkins@xuqm.com"
-            git config user.name "Jenkins CI"
-            git add ${env.VERSION_FILE}
-            git diff --cached --quiet || git commit -m "ci: bump ${env.IMAGE_NAME} to ${env.IMAGE_VERSION} [skip ci]"
-            git push origin HEAD:main
-          """
+        sshagent(credentials: ['jenkins-ssh-key']) {
+          script {
+            bat """
+              git config user.email "jenkins@xuqm.com"
+              git config user.name "Jenkins CI"
+              git add ${env.VERSION_FILE}
+              git diff --cached --quiet || git commit -m "ci: bump ${env.IMAGE_NAME} to ${env.IMAGE_VERSION} [skip ci]"
+              git push origin HEAD:main
+            """
+          }
         }
       }
     }
diff --git a/docs/SDK_PLATFORM_V2_HANDOFF.md b/docs/SDK_PLATFORM_V2_HANDOFF.md
index 8daeea2..57e7d59 100644
--- a/docs/SDK_PLATFORM_V2_HANDOFF.md
+++ b/docs/SDK_PLATFORM_V2_HANDOFF.md
@@ -33,3 +33,11 @@ nginx -t -p "$PWD/" -c scripts/nginx-test.conf
 HTML 引用、版本目录、Nginx 缓存头及 Docker 上一版本保留门禁。
 
 Jenkins 和线上部署需由发布流程另行执行；本地构建不能代替生产响应头验收。
+# 2026-07-27 Jenkins SCM 凭据收口
+
+- tenant-web 显式 checkout 已改用 Gitea SSH URL 和 Jenkins
+  `jenkins-ssh-key`，不再引用未配置的 `XUQM_GIT_CREDENTIALS`；其它 Web 作业继续
+  复用各自 Jenkins SCM 配置。三套 Web 流水线的版本文件回写均使用
+  `sshagent(jenkins-ssh-key)`，避免 checkout 结束后 push 缺少凭据。
+- 该修改尚未通过下一次 Web Jenkins 构建验证；缓存策略提交部署前必须先确认
+  checkout 与三套前端构建均成功。