diff --git a/.github/workflows/deploy-ai-workspace-iac.yaml b/.github/workflows/deploy-ai-workspace-iac.yaml
index aea83f1..21f0919 100644
--- a/.github/workflows/deploy-ai-workspace-iac.yaml
+++ b/.github/workflows/deploy-ai-workspace-iac.yaml
@@ -304,6 +304,9 @@ jobs:
           fi
           [ "$missing" -eq 0 ] || { echo "::error::必需机密缺失，终止 deploy"; exit 1; }
 
+      - name: Checkout xworkspace-console helpers
+        uses: actions/checkout@v4
+
       - name: Download CMDB (host IP source)
         uses: actions/download-artifact@v4
         with:
@@ -349,7 +352,7 @@ jobs:
           DEEPSEEK_API_KEY: ${{ steps.vault.outputs.DEEPSEEK_API_KEY }}
           NVIDIA_API_KEY: ${{ steps.vault.outputs.NVIDIA_API_KEY }}
           OLLAMA_API_KEY: ${{ steps.vault.outputs.OLLAMA_API_KEY }}
-        run: scripts/run-on-host-bootstrap.sh
+        run: bash scripts/run-on-host-bootstrap.sh
 
   # ---------------------------------------------------------------------------
   dns:
diff --git a/scripts/run-on-host-bootstrap.sh b/scripts/run-on-host-bootstrap.sh
index bb046a0..acfdd60 100644
--- a/scripts/run-on-host-bootstrap.sh
+++ b/scripts/run-on-host-bootstrap.sh
@@ -4,6 +4,7 @@ set -euo pipefail
 cmdb_path=${CMDB_PATH:-cmdb/cmdb.json}
 host=${MATRIX_HOST:?MATRIX_HOST is required}
 ssh_key=${SSH_KEY_PATH:-"$HOME/.ssh/id_deploy"}
+ssh_key="${ssh_key/#\~/$HOME}"
 run_id=${GITHUB_RUN_ID:-manual}
 
 ip="$(jq -r --arg host "$host" '.[$host].ip' "$cmdb_path")"