diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 8e2250b..2df7c35 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -92,6 +92,34 @@ jobs:
             exit 1
           fi
 
+      - name: Deploy NestJS Worker
+        run: |
+          cd /opt/zhixi/backend
+          sudo cp deploy/zhixi-nest-worker.service /etc/systemd/system/
+          sudo systemctl daemon-reload
+          sudo systemctl reset-failed zhixi-nest-worker 2>/dev/null || true
+          sudo systemctl restart zhixi-nest-worker
+          sleep 5
+          echo "[deploy] Worker status: $(sudo systemctl is-active zhixi-nest-worker)"
+          echo "[deploy] Worker startup log:"
+          sudo journalctl -u zhixi-nest-worker --no-pager -n 10
+
+      - name: Run M-AI-01 integration tests
+        run: |
+          cd /tmp/api-server
+          bash test/run-integration-ci.sh
+        env:
+          DATABASE_URL: mysql://zhixi_user:hKHQ+N0wBjJAiLukFu5OMEI8@127.0.0.1:3306/zhixi_prod
+          REDIS_HOST: 127.0.0.1
+          REDIS_PORT: '6379'
+          REDIS_PASSWORD: THTC2B5wXvhlMw/ZB6TYwB6MI9r1tO0F
+          JWT_SECRET: test-integration-secret
+          INTERNAL_API_KEY: test-key
+          CREDENTIAL_ENCRYPTION_KEY: '0123456789abcdef0123456789abcdef'
+          STORAGE_DRIVER: local
+          MYSQL_ROOT_PASSWORD: Zhixi@2026!Root_8C
+        timeout-minutes: 10
+
       - name: Deploy RAG Worker
         run: |
           set -e
diff --git a/test/helpers/integration-harness.ts b/test/helpers/integration-harness.ts
index 98addbe..665f1f5 100644
--- a/test/helpers/integration-harness.ts
+++ b/test/helpers/integration-harness.ts
@@ -107,7 +107,7 @@ function envForProcess(baseEnv: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
   };
 }
 
-export async function startAPI(mockUrl: string, dbUrl: string, redisHost: string, redisPort: string, redisPw: string): Promise<number> {
+export async function startAPI(mockUrl: string, dbUrl: string, redisHost: string, redisPort: string, redisPw: string, jwtSecret?: string): Promise<number> {
   mockAIUrl = mockUrl;
   return new Promise((resolve, reject) => {
     const env = envForProcess(process.env);
@@ -115,6 +115,7 @@ export async function startAPI(mockUrl: string, dbUrl: string, redisHost: string
       DATABASE_URL: dbUrl,
       REDIS_HOST: redisHost, REDIS_PORT: redisPort,
       REDIS_PASSWORD: redisPw, REDIS_DB: '0',
+      JWT_SECRET: jwtSecret || process.env.JWT_SECRET || 'test-integration-secret',
     });
 
     apiProc = spawn('node', ['dist/src/main.js'], { env, stdio: ['ignore', 'pipe', 'pipe'] });
@@ -135,13 +136,14 @@ export async function startAPI(mockUrl: string, dbUrl: string, redisHost: string
   });
 }
 
-export async function startWorker(dbUrl: string, redisHost: string, redisPort: string, redisPw: string, instanceId: string): Promise<number> {
+export async function startWorker(dbUrl: string, redisHost: string, redisPort: string, redisPw: string, instanceId: string, jwtSecret?: string): Promise<number> {
   return new Promise((resolve, reject) => {
     const env = envForProcess(process.env);
     Object.assign(env, {
       DATABASE_URL: dbUrl, REDIS_HOST: redisHost, REDIS_PORT: redisPort,
       REDIS_PASSWORD: redisPw, REDIS_DB: '0',
       WORKER_INSTANCE_ID: instanceId,
+      JWT_SECRET: jwtSecret || process.env.JWT_SECRET || 'test-integration-secret',
     });
 
     workerProc = spawn('node', ['dist/src/worker.main.js'], { env, stdio: ['ignore', 'pipe', 'pipe'] });
diff --git a/test/m-ai-01-09-api-e2e.worker-int-spec.ts b/test/m-ai-01-09-api-e2e.worker-int-spec.ts
index 49daab4..0e0de29 100644
--- a/test/m-ai-01-09-api-e2e.worker-int-spec.ts
+++ b/test/m-ai-01-09-api-e2e.worker-int-spec.ts
@@ -50,9 +50,9 @@ beforeAll(async () => {
   console.log(`[api-e2e] JWT: ${userToken.slice(0, 20)}...`);
 
   // Start API + Worker
-  const apiPid = await startAPI(mockAI.url, DB_URL, REDIS_HOST, REDIS_PORT, REDIS_PW);
+  const apiPid = await startAPI(mockAI.url, DB_URL, REDIS_HOST, REDIS_PORT, REDIS_PW, JWT_SECRET);
   console.log(`[api-e2e] API pid=${apiPid}`);
-  const workerPid = await startWorker(DB_URL, REDIS_HOST, REDIS_PORT, REDIS_PW, `e2e-worker-${Date.now()}`);
+  const workerPid = await startWorker(DB_URL, REDIS_HOST, REDIS_PORT, REDIS_PW, `e2e-worker-${Date.now()}`, JWT_SECRET);
   console.log(`[api-e2e] Worker pid=${workerPid}`);
   await new Promise(r => setTimeout(r, 3000));
 }, 60_000);
diff --git a/test/m-ai-01-09.worker-int-spec.ts b/test/m-ai-01-09.worker-int-spec.ts
index a0876d2..726bb97 100644
--- a/test/m-ai-01-09.worker-int-spec.ts
+++ b/test/m-ai-01-09.worker-int-spec.ts
@@ -43,11 +43,12 @@ beforeAll(async () => {
   setRedisConfig(REDIS_HOST, REDIS_PORT, REDIS_PW || undefined);
 
   // 4. Start API
-  const apiPid = await startAPI(mockAI.url, DB_URL, REDIS_HOST, String(REDIS_PORT), REDIS_PW);
+  const JWT_SEC = process.env.JWT_SECRET || 'test-integration-secret';
+  const apiPid = await startAPI(mockAI.url, DB_URL, REDIS_HOST, String(REDIS_PORT), REDIS_PW, JWT_SEC);
   console.log(`[test] API started, pid=${apiPid}`);
 
   // 5. Start Worker
-  const workerPid = await startWorker(DB_URL, REDIS_HOST, String(REDIS_PORT), REDIS_PW, `test-worker-${Date.now()}`);
+  const workerPid = await startWorker(DB_URL, REDIS_HOST, String(REDIS_PORT), REDIS_PW, `test-worker-${Date.now()}`, JWT_SEC);
   console.log(`[test] Worker started, pid=${workerPid}`);
 
   await new Promise(r => setTimeout(r, 3000));