diff --git a/ops/agent/guideng-agent.service b/ops/agent/guideng-agent.service
index c2d249d..6a76fca 100644
--- a/ops/agent/guideng-agent.service
+++ b/ops/agent/guideng-agent.service
@@ -6,13 +6,19 @@ Wants=network-online.target
 [Service]
 Type=simple
 User=guideng
-EnvironmentFile=/etc/guideng/secret.env
+Group=guideng
+EnvironmentFile=-/etc/guanghu/persona-secrets/shared-deepseek.env
+Environment=GUIDENG_REPO=/var/lib/guanghu/personas/guideng/repository
+Environment=GUIDENG_CONFIG=/opt/guideng/agent/agent.json
 ExecStart=/usr/bin/python3 /opt/guideng/agent/guideng_agent.py
 Restart=on-failure
 RestartSec=30
 NoNewPrivileges=true
+PrivateTmp=true
 ProtectSystem=strict
-ReadWritePaths=/opt/guideng/repo /var/lib/guideng
+ProtectHome=true
+ReadWritePaths=/var/lib/guanghu/personas/guideng
+ReadOnlyPaths=/opt/guideng/agent /etc/guanghu/persona-secrets
 
 [Install]
 WantedBy=multi-user.target
diff --git a/ops/agent/guideng_agent.py b/ops/agent/guideng_agent.py
index f4a8ed4..7f09d69 100644
--- a/ops/agent/guideng_agent.py
+++ b/ops/agent/guideng_agent.py
@@ -6,9 +6,9 @@ import json, os, subprocess, sys, urllib.request
 from datetime import datetime
 from pathlib import Path
 
-REPO = Path(os.environ.get("GUIDENG_REPO", "/opt/guideng/repo"))
+REPO = Path(os.environ.get("GUIDENG_REPO", "/var/lib/guanghu/personas/guideng/repository"))
 CFG = json.loads(Path(os.environ.get("GUIDENG_CONFIG", "/etc/guideng/agent.json")).read_text())
-API_KEY = os.environ["GUIDENG_MODEL_API_KEY"]  # 只从环境注入, 服务器 secret.env 提供
+API_KEY = os.environ.get("GUIDENG_MODEL_API_KEY") or os.environ["DEEPSEEK_API_KEY"]
 TZ = CFG.get("timezone", "Asia/Shanghai")
 
 def sh(*args, check=True):
@@ -37,8 +37,8 @@ def call_model(messages):
 
 def heartbeat():
     today = datetime.now().strftime("%Y-%m-%d")
-    sh("git", "fetch", "origin", check=False)
-    sh("git", "pull", "--rebase", "origin", "main", check=False)
+    sh("git", "fetch", "origin")
+    sh("git", "pull", "--rebase", "origin", "main")
 
     channel = (REPO / "lake-heart-channel/冰朔的湖心频道.md").read_text(encoding="utf-8")
     identity = load_identity()
@@ -73,7 +73,7 @@ def heartbeat():
         sh("git", "-c", "user.name=归灯 GLS-LA-20260720-003 · 铸渊 ICE-GL-ZY001",
            "-c", "user.email=ICE-GL-ZY001@fifth-domain.local",
            "commit", "-m", f"归灯 · {today} 心跳 · 签到与湖心回音\n\n国作登字-2026-A-00037559")
-        sh("git", "push", "origin", "main", check=False)
+        sh("git", "push", "origin", "main")
 
 if __name__ == "__main__":
     if "--once" in sys.argv: