diff --git a/.gitignore b/.gitignore
index 514c05c..877031b 100755
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,7 @@
 .DS_Store
 .env
 .env.*
+credentials.env
 *.db
 *.sqlite
 *.sqlite3
diff --git a/README.md b/README.md
index e5ae87c..8432b85 100755
--- a/README.md
+++ b/README.md
@@ -25,7 +25,7 @@ https://ops.roasbloom.site/af-click-gap/
 /Users/ads-center/ubuntu/Gitea/af-click-gap/scripts/run_pipeline.sh
 ```
 
-流水线脚本必须从 `direct-report-dashboard/.env` 读取 `AGENTSTAGE_USER` 和 `AGENTSTAGE_TOKEN`。默认读取项目 sibling 目录的 `.env`，也可通过 `ENV_FILE` 指定路径；只解析这两个变量，不执行整个 `.env`。凭据只通过临时 `GIT_ASKPASS` 提供给 Git，不写入 remote URL、命令行、日志或仓库。
+流水线脚本从用户目录的 `~/.config/gitea/credentials.env` 读取共享 Gitea 凭证（变量名为 `GITEA_USER` 和 `GITEA_TOKEN`），文件权限必须为 `600`，并要求账号为 `liuji`。凭据只通过临时 `GIT_ASKPASS` 提供给 Git，不写入 remote URL、命令行、日志或仓库。不要把该文件提交到仓库。业务配置仍可使用项目自己的 `.env`。
 
 ## 手动运行
 
diff --git a/scripts/run_pipeline.sh b/scripts/run_pipeline.sh
index 71f6f7d..b8c653a 100755
--- a/scripts/run_pipeline.sh
+++ b/scripts/run_pipeline.sh
@@ -4,33 +4,24 @@ set -eu
 
 SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 PROJECT_ROOT=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
-# ENV_FILE is an explicit override; by default it is the sibling dashboard .env.
-ENV_FILE=${ENV_FILE:-$(CDPATH= cd -- "$PROJECT_ROOT/../direct-report-dashboard" && pwd)/.env}
 PYTHON_BIN=${PYTHON_BIN:-python3}
+CREDENTIALS_FILE=${HOME:?}/.config/gitea/credentials.env
 
-if [ ! -r "$ENV_FILE" ]; then
-    printf '%s\n' "Credential file is not readable: $ENV_FILE" >&2
+if [ ! -r "$CREDENTIALS_FILE" ]; then
+    printf '%s\n' "Credential file is not readable: $CREDENTIALS_FILE" >&2
+    exit 1
+fi
+if [ "$(stat -f '%Lp' "$CREDENTIALS_FILE")" != 600 ]; then
+    printf '%s\n' "Credential file must have mode 600: $CREDENTIALS_FILE" >&2
     exit 1
 fi
 
-# Read only the two Git credential variables; do not source the .env file.
-dotenv_value() {
-    awk -v wanted="$1" '
-        $0 ~ "^[[:space:]]*" wanted "[[:space:]]*=" {
-            sub("^[[:space:]]*" wanted "[[:space:]]*=", "")
-            if ($0 ~ /^".*"[[:space:]]*$/) {
-                sub(/^"/, ""); sub(/"[[:space:]]*$/, "")
-            } else if ($0 ~ /^'"'"'.*'"'"'[[:space:]]*$/) {
-                sub(/^'"'"'/, ""); sub(/'"'"'[[:space:]]*$/, "")
-            }
-            print
-            exit
-        }
-    ' "$ENV_FILE"
+credential_value() {
+    awk -F= -v wanted="$1" '$1 ~ "^[[:space:]]*" wanted "[[:space:]]*$" { sub(/^[[:space:]]*/, "", $2); sub(/[[:space:]]*$/, "", $2); print $2; exit }' "$CREDENTIALS_FILE"
 }
 
-AGENTSTAGE_USER=$(dotenv_value AGENTSTAGE_USER)
-AGENTSTAGE_TOKEN=$(dotenv_value AGENTSTAGE_TOKEN)
+AGENTSTAGE_USER=$(credential_value GITEA_USER)
+AGENTSTAGE_TOKEN=$(credential_value GITEA_TOKEN)
 missing=''
 [ -n "$AGENTSTAGE_USER" ] || missing="$missing AGENTSTAGE_USER"
 [ -n "$AGENTSTAGE_TOKEN" ] || missing="$missing AGENTSTAGE_TOKEN"