diff --git a/docs/reference/g14-gitops-cicd.md b/docs/reference/g14-gitops-cicd.md
index 16b745fd..e75983a3 100644
--- a/docs/reference/g14-gitops-cicd.md
+++ b/docs/reference/g14-gitops-cicd.md
@@ -18,6 +18,7 @@ G14 是 HWLAB 的旁路 DEV 集群目标。G14 CI/CD 必须只作用于 G14 k3s
 - 读取 `deploy/deploy.json` 与 `deploy/k8s/*`，生成 Argo CD 可消费的 G14 runtime Kustomize path。
 - 默认输出到 `deploy/gitops/g14/`。
 - 默认 registry prefix 是 `127.0.0.1:5000/hwlab`，用于 G14 单节点 k3s 的 node-local registry。
+- 默认 CI/CD proxy 是 G14 本机 `http://127.0.0.1:10808` / `socks5h://127.0.0.1:10808`。Tekton CI step、Docker-in-Docker sidecar 和 publish step 都注入 proxy/no_proxy，保证 npm、Playwright、base image 拉取和 registry push 走 G14 本机代理边界。
 
 常用命令：
 
@@ -34,6 +35,8 @@ npm run g14:gitops:check
 
 G14 registry 由 Kubernetes Deployment `hwlab-ci/hwlab-registry` 承载，使用 host network 暴露 `127.0.0.1:5000` 给 k3s/containerd 和 host-network Tekton build pod。旧 host Docker registry 不能与该 Deployment 同时占用 5000 端口。
 
+G14 k3s/containerd 的 Pod 镜像拉取也必须长期使用 G14 本机代理。主机配置记录在 `/root/docs/kubernetes-ops.md`，当前 systemd env 文件是 `/etc/systemd/system/k3s.service.env`。修改代理后需要 `systemctl daemon-reload && systemctl restart k3s`，并确认 `k3s-server` 进程环境中存在 `HTTP_PROXY` / `NO_PROXY`。
+
 ## 凭证边界
 
 HWLAB repo 是私有仓库时，Tekton 和 Argo CD 需要各自的 Git SSH Secret。Secret 只能从 G14 本机已有 SSH key 创建，不能写入 Git，不能打印 key 内容。
diff --git a/scripts/g14-gitops-render.mjs b/scripts/g14-gitops-render.mjs
index 382d91f3..63563ae8 100644
--- a/scripts/g14-gitops-render.mjs
+++ b/scripts/g14-gitops-render.mjs
@@ -14,8 +14,24 @@ const defaultSourceRepo = process.env.HWLAB_G14_GIT_URL || "git@github.com:pikas
 const defaultBranch = process.env.HWLAB_G14_BRANCH || "G14";
 const defaultRuntimeEndpoint = "http://hwlab-edge-proxy.hwlab-dev.svc.cluster.local:6667";
 const defaultWebEndpoint = "http://hwlab-cloud-web.hwlab-dev.svc.cluster.local:8080";
+const defaultProxyUrl = process.env.HWLAB_G14_PROXY_URL || "http://127.0.0.1:10808";
+const defaultAllProxyUrl = process.env.HWLAB_G14_ALL_PROXY_URL || "socks5h://127.0.0.1:10808";
+const defaultNoProxy = process.env.HWLAB_G14_NO_PROXY || "127.0.0.1,localhost,::1,10.0.0.0/8,10.42.0.0/16,10.43.0.0/16,192.168.0.0/16,.svc,.cluster.local,kubernetes.default.svc,registry.hwlab-ci.svc,hwlab-registry.hwlab-ci.svc";
 const sourceCommitPattern = /^[a-f0-9]{7,40}$/u;
 
+function proxyEnv() {
+  return [
+    { name: "HTTP_PROXY", value: defaultProxyUrl },
+    { name: "HTTPS_PROXY", value: defaultProxyUrl },
+    { name: "ALL_PROXY", value: defaultAllProxyUrl },
+    { name: "NO_PROXY", value: defaultNoProxy },
+    { name: "http_proxy", value: defaultProxyUrl },
+    { name: "https_proxy", value: defaultProxyUrl },
+    { name: "all_proxy", value: defaultAllProxyUrl },
+    { name: "no_proxy", value: defaultNoProxy }
+  ];
+}
+
 function parseArgs(argv) {
   const args = {
     outDir: defaultOutDir,
@@ -397,7 +413,7 @@ function tektonPipeline(ci) {
               { name: "revision" }
             ],
             workspaces: [{ name: "source" }, { name: "git-ssh" }],
-            steps: [{ name: "ci-json", image: "mcr.microsoft.com/playwright:v1.59.1-noble", script: ciJsonScript(ci) }]
+            steps: [{ name: "ci-json", image: "mcr.microsoft.com/playwright:v1.59.1-noble", env: proxyEnv(), script: ciJsonScript(ci) }]
           },
           params: [
             { name: "git-url", value: "$(params.git-url)" },
@@ -423,14 +439,14 @@ function tektonPipeline(ci) {
               name: "docker",
               image: "docker:29-dind",
               args: ["--host=unix:///var/run/docker.sock", "--storage-driver=vfs"],
-              env: [{ name: "DOCKER_TLS_CERTDIR", value: "" }],
+              env: [{ name: "DOCKER_TLS_CERTDIR", value: "" }, ...proxyEnv()],
               securityContext: { privileged: true },
               volumeMounts: [{ name: "docker-run", mountPath: "/var/run" }]
             }],
             steps: [{
               name: "publish",
               image: "node:22-alpine",
-              env: [{ name: "DOCKER_HOST", value: "unix:///var/run/docker.sock" }],
+              env: [{ name: "DOCKER_HOST", value: "unix:///var/run/docker.sock" }, ...proxyEnv()],
               volumeMounts: [{ name: "docker-run", mountPath: "/var/run" }],
               script: publishScript()
             }]