diff --git a/.gitea/workflows/trigger-jenkins.yml b/.gitea/workflows/trigger-jenkins.yml
new file mode 100644
index 0000000..0731f23
--- /dev/null
+++ b/.gitea/workflows/trigger-jenkins.yml
@@ -0,0 +1,74 @@
+name: trigger-jenkins-oss
+
+# 打 tag 时触发 Jenkins 构建开源镜像并推送到镜像仓库。
+# 仅在 tag 推送时触发；main 分支的日常提交不触发。
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+# 同一 ref 连续触发时取消旧任务，只跑最新的
+concurrency:
+  group: ${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  trigger:
+    runs-on: host
+    steps:
+      - name: 触发 Jenkins 镜像构建
+        env:
+          JU: ${{ secrets.JENKINS_USER }}
+          JT: ${{ secrets.JENKINS_API_TOKEN }}
+          JURL: ${{ secrets.JENKINS_URL }}
+          REPO_NAME: ${{ github.event.repository.name }}
+          TAG_NAME: ${{ github.ref_name }}
+        run: |
+          set -eu
+
+          # 只有 tag 推送才构建；手动触发时按 tag 取，没有就退出
+          case "${GITHUB_REF:-}" in
+            refs/tags/v*) ;;
+            *)
+              if [ "${GITHUB_EVENT_NAME:-}" != "workflow_dispatch" ]; then
+                echo "非 tag 推送，跳过：${GITHUB_REF:-unknown}"
+                exit 0
+              fi
+              ;;
+          esac
+
+          if [ -z "${TAG_NAME:-}" ]; then
+            echo "未取到 tag 名，退出"
+            exit 1
+          fi
+
+          echo "仓库：$REPO_NAME   版本：$TAG_NAME"
+
+          WORK=$(mktemp -d)
+          trap 'rm -rf "$WORK"' EXIT
+
+          # 取 CSRF crumb
+          curl -s -c "$WORK/cj" -u "$JU:$JT" "$JURL/crumbIssuer/api/json" -o "$WORK/crumb.json"
+          CR=$(python3 -c "import json;print(json.load(open('$WORK/crumb.json'))['crumb'])")
+
+          # 触发参数化任务：SERVICES=仓库名，VERSION=tag
+          code=$(curl -s -o "$WORK/out" -w '%{http_code}' -X POST -b "$WORK/cj" -u "$JU:$JT" \
+            -H "Jenkins-Crumb: $CR" \
+            --data-urlencode "SERVICES=$REPO_NAME" \
+            --data-urlencode "VERSION=$TAG_NAME" \
+            --data-urlencode "FORCE=true" \
+            "$JURL/job/iotlcm-oss-build/buildWithParameters")
+
+          echo "Jenkins 触发 HTTP $code"
+          if [ "$code" != "201" ] && [ "$code" != "200" ] && [ "$code" != "302" ] && [ "$code" != "303" ]; then
+            echo "触发失败："
+            cat "$WORK/out"
+            exit 1
+          fi
+
+          LINK="$JURL/job/iotlcm-oss-build/"
+          echo "=========================================="
+          echo "Jenkins 构建：$LINK"
+          echo "=========================================="
+          echo "::notice title=Jenkins 镜像构建::[$LINK]($LINK)"