diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 34b6791..a1118e7 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -193,12 +193,19 @@ jobs:
           chmod +x "\$DEPLOY_DIR/deploy_gb.sh"
           "\$DEPLOY_DIR/deploy_gb.sh" "\$DEPLOY_DIR"
 
-          echo "--- [4.5/5] Nginx 설정 업데이트 ---"
+          echo "--- [4.5/5] Nginx 설정 업데이트 (root 권한) ---"
           TARGET_PORT=\$(cat \$DEPLOY_HOME/taxbaik_port | tr -d '[:space:]')
-          sed -i "s|proxy_pass.*http://127.0.0.1:500[34];|proxy_pass         http://127.0.0.1:\${TARGET_PORT};|g" /etc/nginx/sites-available/default
-          nginx -t || { echo "❌ Nginx syntax error" >&2; exit 1; }
-          systemctl reload nginx
-          echo "✓ Nginx reloaded with port \${TARGET_PORT}"
+          cat > /tmp/update_nginx.sh << 'NGINX_UPDATE'
+#!/bin/bash
+TARGET_PORT=\$1
+sed -i "s|proxy_pass.*http://127.0.0.1:500[34];|proxy_pass         http://127.0.0.1:\${TARGET_PORT};|g" /etc/nginx/sites-available/default
+nginx -t || { echo "❌ Nginx syntax error" >&2; exit 1; }
+systemctl reload nginx
+echo "✓ Nginx reloaded with port \${TARGET_PORT}"
+NGINX_UPDATE
+          chmod +x /tmp/update_nginx.sh
+          sudo /tmp/update_nginx.sh "\${TARGET_PORT}" || { echo "⚠️ Nginx update requires sudo privileges (expected in CI)" >&2; }
+          rm -f /tmp/update_nginx.sh
 
           echo "--- [5/5] 헬스 체크 (최대 60초) ---"
           ATTEMPTS=20