diff --git a/.gitea/workflows/sync-consul.yml b/.gitea/workflows/sync-consul.yml
index 0eca258..e50f68d 100644
--- a/.gitea/workflows/sync-consul.yml
+++ b/.gitea/workflows/sync-consul.yml
@@ -24,10 +24,13 @@ jobs:
             test)
               export KUBECONFIG=/etc/rancher/k3s/k3s-test.yaml
               export NAMESPACE=test
+              # 内网 NodePort（consul-ci）；安全组仅 42→13:30850
+              export CONSUL_HTTP_ADDR="${TEST_CONSUL_HTTP_ADDR:-http://172.16.16.13:30850}"
               ;;
             *)
               export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
               export NAMESPACE=prod
+              unset CONSUL_HTTP_ADDR
               ;;
           esac
           if [[ ! -f "$KUBECONFIG" ]]; then
diff --git a/README.md b/README.md
index 7897819..76f6fb8 100644
--- a/README.md
+++ b/README.md
@@ -72,18 +72,21 @@ export NAMESPACE=prod
 
 改 JSON → push `master` / `test` → workflow 按分支写入对应 Consul 并 `rollout restart`。
 
-手动（在 runner 机上；跨集群会自动 port-forward）：
+手动（在 runner 机上）：
 
 ```bash
-# prod
+# prod（ClusterIP，本机可达）
 export KUBECONFIG=/etc/rancher/k3s/k3s.yaml NAMESPACE=prod
 ./scripts/sync-to-consul.sh
 
-# test
+# test（内网 NodePort consul-ci；安全组仅 runner→13:30850）
 export KUBECONFIG=/etc/rancher/k3s/k3s-test.yaml NAMESPACE=test
+export CONSUL_HTTP_ADDR=http://172.16.16.13:30850
 ./scripts/sync-to-consul.sh
 ```
 
+Consul **不要**走公网 Ingress；集群内业务仍用 `consul.test.svc:8500`。
+
 ## 密钥来源
 
 | 占位符 | Secret（在目标 NAMESPACE 内） |
diff --git a/scripts/export-from-consul.sh b/scripts/export-from-consul.sh
index 9430fa4..cfde80a 100644
--- a/scripts/export-from-consul.sh
+++ b/scripts/export-from-consul.sh
@@ -35,32 +35,13 @@ json_ok_str() {
     jq empty <<<"$raw"
   fi
 }
-# Consul：跨集群时 ClusterIP 不可达 → port-forward
-CONSUL_PF_PID=""
-cleanup_pf() {
-  if [[ -n "${CONSUL_PF_PID:-}" ]]; then
-    kill "$CONSUL_PF_PID" 2>/dev/null || true
-    wait "$CONSUL_PF_PID" 2>/dev/null || true
-    CONSUL_PF_PID=""
-  fi
-}
-trap cleanup_pf EXIT
-
 if [[ -z "${CONSUL_HTTP_ADDR:-}" ]]; then
-  LOCAL_PORT=18510
-  echo "==> port-forward svc/consul → 127.0.0.1:${LOCAL_PORT} (ns=${NS})"
-  kubectl -n "$NS" port-forward svc/consul "${LOCAL_PORT}:8500" >/tmp/consul-pf-export-${NS}.log 2>&1 &
-  CONSUL_PF_PID=$!
-  ok=0
-  for _ in $(seq 1 40); do
-    if curl -sf --connect-timeout 1 "http://127.0.0.1:${LOCAL_PORT}/v1/status/leader" >/dev/null 2>&1; then
-      ok=1
-      break
-    fi
-    sleep 0.5
-  done
-  [[ "$ok" == "1" ]] || { echo "FAIL: Consul port-forward 未就绪"; cat /tmp/consul-pf-export-${NS}.log 2>/dev/null || true; exit 1; }
-  CONSUL_HTTP_ADDR="http://127.0.0.1:${LOCAL_PORT}"
+  if [[ "$NS" == "test" ]]; then
+    CONSUL_HTTP_ADDR="${TEST_CONSUL_HTTP_ADDR:-http://172.16.16.13:30850}"
+  else
+    CIP="$(kubectl -n "$NS" get svc consul -o jsonpath='{.spec.clusterIP}')"
+    CONSUL_HTTP_ADDR="http://${CIP}:8500"
+  fi
 fi
 echo "==> Consul ${CONSUL_HTTP_ADDR}"
 
diff --git a/scripts/sync-to-consul.sh b/scripts/sync-to-consul.sh
index b5d39eb..8bc4d11 100644
--- a/scripts/sync-to-consul.sh
+++ b/scripts/sync-to-consul.sh
@@ -147,54 +147,15 @@ load_secret JWT_SECRET_KEY prod-credentials JWT_SECRET_KEY
 : "${ELASTIC_PASSWORD:?缺少 ELASTIC_PASSWORD}"
 : "${JWT_SECRET_KEY:?缺少 JWT_SECRET_KEY（请创建 secret/jwt-secret 或写入 prod-credentials）}"
 
-# Consul：runner 可能在另一集群节点上，ClusterIP 不可达 → 一律 port-forward 到本机
-CONSUL_PF_PID=""
-cleanup() {
-  if [[ -n "${CONSUL_PF_PID:-}" ]]; then
-    kill "$CONSUL_PF_PID" 2>/dev/null || true
-    wait "$CONSUL_PF_PID" 2>/dev/null || true
-    CONSUL_PF_PID=""
-  fi
-  [[ -n "${TMP:-}" && -d "${TMP:-}" ]] && rm -rf "$TMP"
-}
-trap cleanup EXIT
-
+# Consul：prod 用 ClusterIP（runner 在簇内）；test 用内网 NodePort（见 consul-ci / TEST_CONSUL_HTTP_ADDR）
 if [[ -z "$CONSUL_HTTP_ADDR" ]]; then
-  if ! kubectl -n "$NS" get svc consul >/dev/null 2>&1; then
-    echo "FAIL: 无 svc/${NS}/consul（KUBECONFIG=${KUBECONFIG}）"
-    exit 1
+  if [[ "$NS" == "test" ]]; then
+    # 安全组：仅放行 CI 机内网 → 测试机 30850；勿对公网开放
+    CONSUL_HTTP_ADDR="${TEST_CONSUL_HTTP_ADDR:-http://172.16.16.13:30850}"
+  else
+    CIP="$(kubectl -n "$NS" get svc consul -o jsonpath='{.spec.clusterIP}')"
+    CONSUL_HTTP_ADDR="http://${CIP}:8500"
   fi
-  # 避开常用端口；失败则换一个
-  LOCAL_PORT=""
-  for p in 18500 18501 18502 18503 18504; do
-    if ! ss -ltn 2>/dev/null | grep -q ":${p} " && ! netstat -ltn 2>/dev/null | grep -q ":${p} "; then
-      LOCAL_PORT=$p
-      break
-    fi
-  done
-  LOCAL_PORT="${LOCAL_PORT:-18500}"
-  echo "==> port-forward svc/consul → 127.0.0.1:${LOCAL_PORT} (ns=${NS})"
-  kubectl -n "$NS" port-forward svc/consul "${LOCAL_PORT}:8500" >/tmp/consul-pf-${NS}.log 2>&1 &
-  CONSUL_PF_PID=$!
-  ok=0
-  for _ in $(seq 1 40); do
-    if ! kill -0 "$CONSUL_PF_PID" 2>/dev/null; then
-      echo "FAIL: port-forward 已退出，见 /tmp/consul-pf-${NS}.log"
-      cat /tmp/consul-pf-${NS}.log 2>/dev/null || true
-      exit 1
-    fi
-    if curl -sf --connect-timeout 1 "http://127.0.0.1:${LOCAL_PORT}/v1/status/leader" >/dev/null 2>&1; then
-      ok=1
-      break
-    fi
-    sleep 0.5
-  done
-  if [[ "$ok" != "1" ]]; then
-    echo "FAIL: Consul port-forward 未就绪，见 /tmp/consul-pf-${NS}.log"
-    cat /tmp/consul-pf-${NS}.log 2>/dev/null || true
-    exit 1
-  fi
-  CONSUL_HTTP_ADDR="http://127.0.0.1:${LOCAL_PORT}"
 fi
 echo "==> Consul ${CONSUL_HTTP_ADDR}"
 
@@ -224,6 +185,7 @@ fi
 [[ ${#TARGETS[@]} -gt 0 ]] || { echo "FAIL: 无同步目标"; exit 1; }
 
 TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
 
 put_kv() {
   local key="$1" file="$2"