diff --git a/scripts/publish-github.sh b/scripts/publish-github.sh
index 7085a8f..9fcab17 100755
--- a/scripts/publish-github.sh
+++ b/scripts/publish-github.sh
@@ -62,6 +62,12 @@ if [ "${1:-}" = "--push" ]; then
   fi
   git remote remove github 2>/dev/null || true
   git remote add github "$GITHUB_REMOTE"
-  git push -u github main
+  # 憑證不進 URL/指令行：有 GITHUB_MIRROR_TOKEN 就用 Basic header 注入（PAT）
+  if [ -n "${GITHUB_MIRROR_TOKEN:-}" ]; then
+    AUTH_B64="$(printf '%s:%s' "${GITHUB_ACCOUNT_NAME:-git}" "$GITHUB_MIRROR_TOKEN" | base64 | tr -d '\n')"
+    git -c http."$GITHUB_REMOTE".extraheader="Authorization: Basic $AUTH_B64" push -u github main
+  else
+    git push -u github main
+  fi
   echo "🚀 已 push → $GITHUB_REMOTE"
 fi