diff --git a/README.md b/README.md
index d0451db..a9bcd8a 100644
--- a/README.md
+++ b/README.md
@@ -36,7 +36,7 @@ git commit -m "你的说明"
 git push
 ```
 
-服务器：
+服务器（需代理时先 `export http_proxy=http://192.168.8.246:10810` 等，见 [DEPLOY.md §3](./docs/DEPLOY.md#3-一键部署新服务器)）：
 
 ```bash
 bash /opt/secondary-school-grade-archive/deploy/update.sh
@@ -62,7 +62,7 @@ git commit -m "你的说明"
 git push
 ```
 
-服务器：
+服务器（需代理时先 `export http_proxy=http://192.168.8.246:10810` 等，见 [DEPLOY.md §3](./docs/DEPLOY.md#3-一键部署新服务器)）：
 
 ```bash
 bash /opt/secondary-school-grade-archive/deploy/update.sh
@@ -74,6 +74,15 @@ bash /opt/secondary-school-grade-archive/deploy/update.sh
 
 ## Ubuntu 一键部署（零 Node）
 
+若服务器访问外网需走代理，**先设置代理再执行安装**：
+
+```bash
+export http_proxy=http://192.168.8.246:10810
+export https_proxy=http://192.168.8.246:10810
+export HTTP_PROXY="$http_proxy"
+export HTTPS_PROXY="$https_proxy"
+```
+
 ```bash
 git clone https://git.bz121.com/dekun/secondary-school-grade-archive.git /opt/secondary-school-grade-archive
 cd /opt/secondary-school-grade-archive
@@ -81,6 +90,8 @@ chmod +x deploy/*.sh
 bash deploy/install.sh
 ```
 
+> `install.sh` 会自动将代理用于 `apt`、`git`、`pip`、`curl`。无需代理时可省略 `export` 步骤。
+
 - 安装目录：`/opt/secondary-school-grade-archive`
 - 访问地址：`http://<服务器IP>:23566`
 - 进程管理：`systemctl status grade-archive` / `journalctl -u grade-archive -f`
diff --git a/deploy/install.sh b/deploy/install.sh
index 4f67914..c3a1055 100644
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -20,6 +20,9 @@ log_info()  { echo -e "${GREEN}[INFO]${NC} $*"; }
 log_warn()  { echo -e "${YELLOW}[WARN]${NC} $*"; }
 log_error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
 
+# shellcheck source=proxy.sh
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/proxy.sh"
+
 require_root() {
   if [[ "${EUID:-$(id -u)}" -ne 0 ]]; then
     log_error "请使用 root 用户运行: sudo bash deploy/install.sh"
@@ -207,6 +210,7 @@ print_summary() {
 main() {
   log_info "零 Node 一键部署开始"
   require_root
+  setup_deploy_proxy
   check_os
   check_port
   install_base_packages
diff --git a/deploy/proxy.sh b/deploy/proxy.sh
new file mode 100644
index 0000000..c20e37e
--- /dev/null
+++ b/deploy/proxy.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# 部署脚本共用：读取 HTTP_PROXY / http_proxy 并配置 apt、git、pip、curl
+# 用法（install.sh / update.sh 前）：
+#   export http_proxy=http://192.168.8.246:10810
+#   export https_proxy=http://192.168.8.246:10810
+#   export HTTP_PROXY="$http_proxy"
+#   export HTTPS_PROXY="$https_proxy"
+
+setup_deploy_proxy() {
+  local proxy="${HTTP_PROXY:-${http_proxy:-}}"
+  if [[ -z "$proxy" ]]; then
+    return 0
+  fi
+
+  if [[ "$proxy" != http://* && "$proxy" != https://* && "$proxy" != socks5://* ]]; then
+    proxy="http://${proxy}"
+  fi
+
+  export http_proxy="$proxy"
+  export https_proxy="${HTTPS_PROXY:-${https_proxy:-$proxy}}"
+  export HTTP_PROXY="$http_proxy"
+  export HTTPS_PROXY="$https_proxy"
+  export ALL_PROXY="${ALL_PROXY:-$http_proxy}"
+
+  if [[ -n "${log_info:-}" ]]; then
+    log_info "使用网络代理: ${http_proxy}"
+  else
+    echo "[INFO] 使用网络代理: ${http_proxy}"
+  fi
+
+  mkdir -p /etc/apt/apt.conf.d
+  cat > /etc/apt/apt.conf.d/95grade-archive-proxy <<EOF
+Acquire::http::Proxy "${http_proxy}";
+Acquire::https::Proxy "${https_proxy}";
+EOF
+}
diff --git a/deploy/update.sh b/deploy/update.sh
index 71be9c8..ccbb397 100644
--- a/deploy/update.sh
+++ b/deploy/update.sh
@@ -11,10 +11,15 @@ NC='\033[0m'
 log_info() { echo -e "${GREEN}[INFO]${NC} $*"; }
 log_error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
 
+# shellcheck source=proxy.sh
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/proxy.sh"
+
 cd "${INSTALL_DIR}" || exit 1
 find "${INSTALL_DIR}" -name "*.sh" -exec sed -i 's/\r$//' {} +
 chmod +x deploy/start.sh
 
+setup_deploy_proxy
+
 log_info "拉取最新代码…"
 git fetch origin
 git checkout "${BRANCH}" 2>/dev/null || true
diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md
index b62e78e..647984e 100644
--- a/docs/DEPLOY.md
+++ b/docs/DEPLOY.md
@@ -37,6 +37,8 @@
 
 每次修改代码后，按改动范围在**开发机**操作，再推送到远端仓库，最后在服务器执行 `update.sh`。
 
+> **服务器需代理时**：在 `update.sh` 前设置与 [§3 一键部署](#3-一键部署新服务器) 相同的 `export http_proxy=...` 命令。
+
 ### 流程总览
 
 ```
@@ -105,6 +107,17 @@ bash /opt/secondary-school-grade-archive/deploy/update.sh
 
 ## 3. 一键部署（新服务器）
 
+若服务器访问 Git / apt / PyPI 需走代理，**在 `bash deploy/install.sh` 之前**设置：
+
+```bash
+export http_proxy=http://192.168.8.246:10810
+export https_proxy=http://192.168.8.246:10810
+export HTTP_PROXY="$http_proxy"
+export HTTPS_PROXY="$https_proxy"
+```
+
+完整安装命令：
+
 ```bash
 git clone https://git.bz121.com/dekun/secondary-school-grade-archive.git /opt/secondary-school-grade-archive
 cd /opt/secondary-school-grade-archive
@@ -112,6 +125,8 @@ chmod +x deploy/*.sh
 bash deploy/install.sh
 ```
 
+> 脚本会读取上述环境变量，并自动配置 `apt` 代理。`git pull`、`pip install` 同样生效。内网直连时可不设代理。
+
 脚本自动完成：
 
 1. 安装 PostgreSQL、Python 依赖  
@@ -152,7 +167,11 @@ systemctl status grade-archive
 # 实时日志
 journalctl -u grade-archive -f
 
-# 拉代码并重启（日常更新）
+# 拉代码并重启（日常更新；需代理时先 export，见 §3）
+export http_proxy=http://192.168.8.246:10810
+export https_proxy=http://192.168.8.246:10810
+export HTTP_PROXY="$http_proxy"
+export HTTPS_PROXY="$https_proxy"
 bash /opt/secondary-school-grade-archive/deploy/update.sh
 
 # 备份数据库与 uploads