docs: clarify Cloudflare deployment setup

README.md

@@ -71,11 +71,15 @@ Copy the prompt below directly into an AI Agent (such as Codex, Claude, Cursor,
 ```text
 Deploy EdgeEver online:
 1. Fork https://github.com/tianma-if/edgeever.
-2. Import the Fork into Cloudflare Workers & Pages.
-3. Create D1 `edgeever` and R2 `edgeever-resources`, set the
-   `EDGE_EVER_AUTH_PASSWORD` Worker Secret, and configure the production `main` build.
-4. Start the first build and verify `/api/health`, `/api/openapi.json`, and login.
-5. Enable and manually run the GitHub Actions workflow named `Update deployed EdgeEver`
+2. Create D1 `edgeever` and R2 `edgeever-resources` in Cloudflare.
+3. Import the Fork into Cloudflare Workers & Pages and use `main` as the production
+   branch.
+4. Add a Worker Secret named `EDGE_EVER_AUTH_PASSWORD`, using a password chosen by the
+   user as its value. Prefer a strong password of at least 32 characters that is unique
+   to this instance.
+5. Start the first build, verify `/api/health` and `/api/openapi.json`, then verify login
+   with username `admin` and the configured password.
+6. Enable and manually run the GitHub Actions workflow named `Update deployed EdgeEver`
    once so the Fork can automatically receive the latest EdgeEver features and fixes.
 ```
 
@@ -83,13 +87,14 @@ Deploy EdgeEver online:
 
 ### Option B: Manual Online Deployment
 
-Complete setup in 5 simple web steps:
+Complete setup in 6 web steps:
 
 1. **Fork the Repository**: Click **Fork** at the top right of GitHub to fork EdgeEver into your personal account.
-2. **Enable Actions**: Open the Fork's **Actions** tab and click **I understand my workflows, go ahead and enable them** so the GitHub Actions workflow named **Update deployed EdgeEver** can run automatically, keeping you up to date with the latest **EdgeEver** features and fixes.
-3. **Import into Cloudflare**: Log into the Cloudflare Dashboard, navigate to **Workers & Pages**, and choose to import your Fork repository.
-4. **Create Resources & Credentials**: Create D1 `edgeever` and R2 `edgeever-resources`, then set the Worker Secret `EDGE_EVER_AUTH_PASSWORD` as your admin password. The deploy command creates the bindings; do not edit Fork files.
-5. **Build & Verify**: Start the first build after importing the repository. Once complete, visit `/api/health` to verify a `200` response before logging in.
+2. **Create Cloudflare Resources**: Create D1 `edgeever` and R2 `edgeever-resources`.
+3. **Import & Configure the Project**: Import the Fork into Cloudflare **Workers & Pages** and use `main` as the production branch. The deploy command creates the bindings; do not edit Fork files.
+4. **Set the Administrator Password**: Add a Worker Secret named `EDGE_EVER_AUTH_PASSWORD` and set its value to your chosen administrator login password. Prefer a strong password of at least 32 characters that is unique to this instance.
+5. **Build & Verify**: Start the initial build. Once deployed, confirm `/api/health` returns `200`, then verify login with username `admin` and the configured password.
+6. **Enable Automatic Updates**: Open the Fork's **Actions** tab, click **I understand my workflows, go ahead and enable them**, then manually run **Update deployed EdgeEver** once so the Fork can automatically receive future EdgeEver features and fixes.
 
 > 📖 For full step-by-step instructions and configuration details, see the [Online Deployment Guide](docs/deploy-cloudflare-button.md).
 

README.zh-CN.md

@@ -71,11 +71,13 @@ Cloudflare 在线部署可以选择以下两种方式之一：
 ```text
 请在线完成 EdgeEver 部署：
 1. Fork https://github.com/tianma-if/edgeever。
-2. 将这个 Fork 导入 Cloudflare Workers & Pages。
-3. 创建 D1 `edgeever` 与 R2 `edgeever-resources`，设置
-   `EDGE_EVER_AUTH_PASSWORD` Worker Secret，并配置生产环境 `main` 构建。
-4. 启动首次构建，验证 `/api/health`、`/api/openapi.json` 和登录。
-5. 启用并手动运行一次名为 `Update deployed EdgeEver` 的 GitHub Actions 工作流，
+2. 在 Cloudflare 中创建 D1 `edgeever` 与 R2 `edgeever-resources`。
+3. 将这个 Fork 导入 Cloudflare Workers & Pages，并将 `main` 设为生产分支。
+4. 添加一个名为 `EDGE_EVER_AUTH_PASSWORD` 的 Worker Secret，值为用户自行设置的
+   管理员登录密码，建议使用至少 32 个字符且仅用于此实例的强密码。
+5. 启动首次构建，验证 `/api/health`、`/api/openapi.json`，并使用用户名 `admin`
+   和配置的密码验证登录。
+6. 启用并手动运行一次名为 `Update deployed EdgeEver` 的 GitHub Actions 工作流，
    以便后续自动同步更新，持续获得 EdgeEver 最新的产品特性和问题修复。
 ```
 
@@ -83,13 +85,14 @@ Cloudflare 在线部署可以选择以下两种方式之一：
 
 ### 方案二：手动在线部署
 
-仅需在网页端完成 5 步极简配置：
+仅需在网页端完成 6 步配置：
 
 1. **Fork 仓库**：在 GitHub 点击右上角 **Fork**，将项目 Fork 到您的个人账户下。
-2. **启用 Actions**：进入 Fork 的 **Actions** 标签页，点击 **I understand my workflows, go ahead and enable them**，确保名为 **Update deployed EdgeEver** 的 GitHub Actions 工作流能够自动运行，从而持续获得 **EdgeEver** 最新的产品特性和问题修复。
-3. **导入 Cloudflare**：登录 Cloudflare 控制台，进入 **Workers & Pages**，选择导入该 Fork 仓库。
-4. **创建资源与登录凭据**：创建 D1 `edgeever` 与 R2 `edgeever-resources`，并添加 Worker Secret `EDGE_EVER_AUTH_PASSWORD` 作为管理员登录密码。binding 由部署命令生成，不要修改 Fork 中的文件。
-5. **启动构建与验证**：导入仓库后直接启动首次构建。部署完成后访问 `/api/health`，确认返回 `200` 即可开始使用。
+2. **创建 Cloudflare 资源**：创建 D1 `edgeever` 与 R2 `edgeever-resources`。
+3. **导入并配置项目**：在 Cloudflare **Workers & Pages** 中导入该 Fork，并将 `main` 设为生产分支。binding 由部署命令生成，不要修改 Fork 中的文件。
+4. **设置管理员密码**：添加一个名为 `EDGE_EVER_AUTH_PASSWORD` 的 Worker Secret，并将其值设为您要使用的管理员登录密码。建议使用至少 32 个字符且仅用于此实例的强密码。
+5. **首次构建与验证**：启动首次构建。部署完成后访问 `/api/health`，确认返回 `200`，并使用用户名 `admin` 和配置的密码验证登录。
+6. **启用自动更新**：进入 Fork 的 **Actions** 标签页，点击 **I understand my workflows, go ahead and enable them**，然后手动运行一次 **Update deployed EdgeEver**，确保后续能够自动获得 EdgeEver 的最新功能与修复。
 
 > 📖 包含具体参数与构建命令的详细步骤，请查看 [在线部署完整文档](docs/deploy-cloudflare-button.zh-CN.md)。
 

docs/agent-deploy-cloudflare.md

@@ -11,20 +11,16 @@ This document defines the standard operating specifications and conventions for
 1. **Fork Repository**
    - Fork `tianma-if/edgeever` to the target GitHub account.
 
-2. **Enable Workflow**
-   - In the **Actions** tab of the Forked repository, enable the **Update deployed EdgeEver** automatic update workflow (required on public forks: scheduled workflows are disabled by default).
-   - An ordinary Fork is a deployment mirror by default. No update variable is required: the workflow applies the selected upstream Release's product snapshot to `main` before triggering Cloudflare.
-   - The updater preserves the Fork's complete `.github/workflows/**` directory and its two updater helper scripts as a stable local bootstrap layer. Official packaging, signing, testing, and Release workflows remain guarded to `tianma-if/edgeever` and are never rewritten by downstream product updates.
-   - Only a Fork that intentionally maintains application-code changes should create the Actions repository variable `EDGE_EVER_PRESERVE_FORK_CHANGES=true`. This opts into merges and requires the owner to resolve future conflicts; it is not needed for normal deployments.
+2. **Create Cloudflare Resources**
+   - Create a D1 database named exactly `edgeever`.
+   - Create an R2 bucket named exactly `edgeever-resources`.
 
 3. **Cloudflare Project Import**
    - Log into the Cloudflare **Workers & Pages** console and import the Fork repository.
    - Configure the project to use the repository root, the production `main` branch, and read the root `wrangler.toml`.
 
-4. **Resources & Secrets**
-   - Create a D1 database named exactly `edgeever`.
-   - Create an R2 bucket named exactly `edgeever-resources`.
-   - **Worker Secret**: Add secret `EDGE_EVER_AUTH_PASSWORD` for initial admin password.
+4. **Configure Login Credentials & Instance Settings**
+   - **Worker Secret**: Add secret `EDGE_EVER_AUTH_PASSWORD` for the initial administrator password. Prefer a strong password of at least 32 characters that is unique to this instance.
    - Keep this password only as a Worker runtime Secret; do not copy it into Workers Builds variables. The standard deploy entrypoint reuses and verifies the existing Secret.
    - Do not edit `wrangler.toml` or add duplicate bindings in the Dashboard. The deployment command generates the `DB` and `RESOURCES` bindings from these standard resource names.
    - For an existing Worker deployed from older instructions, do not ask the user to rename or reconfigure a custom R2 bucket. With no explicit override, deployment automatically preserves the live `RESOURCES` binding and administrator username.
@@ -44,10 +40,18 @@ This document defines the standard operating specifications and conventions for
    - Trigger the initial build. Once deployed, run the following automated verifications:
      - Check `https://<your-worker-domain>/api/health` returns HTTP `200` with JSON `{"ok": true}`.
      - Check `https://<your-worker-domain>/api/openapi.json` loads the OpenAPI schema properly.
-     - Verify login API using username `admin` and `EDGE_EVER_AUTH_PASSWORD`. If an advanced deployment sets the `EDGE_EVER_AUTH_USERNAME` Builds variable, use that username instead.
+     - Verify login API using username `admin` and `EDGE_EVER_AUTH_PASSWORD`.
 
 7. **Verify Upstream Update Channel**
+   - In the Fork's **Actions** tab, enable **Update deployed EdgeEver** (required on public forks: scheduled workflows are disabled by default).
+   - An ordinary Fork is a deployment mirror by default. No update variable is required: the workflow applies the selected upstream Release's product snapshot to `main` before triggering Cloudflare.
+   - The updater preserves the Fork's complete `.github/workflows/**` directory and its two updater helper scripts as a stable local bootstrap layer. Official packaging, signing, testing, and Release workflows remain guarded to `tianma-if/edgeever` and are never rewritten by downstream product updates.
+   - Only a Fork that intentionally maintains application-code changes should create the Actions repository variable `EDGE_EVER_PRESERVE_FORK_CHANGES=true`. This opts into merges and requires the owner to resolve future conflicts; it is not needed for normal deployments.
    - Manually trigger **Update deployed EdgeEver** once in the Fork's **Actions** tab. A manual run republishes the selected version even when the Fork is already aligned, ensuring Cloudflare receives a fresh build event.
    - Open the job **Summary** and confirm it reports Fork mode `mirror`, the upstream target (stable Release or edge `main`), and either an update publish or an explicit *already aligned* result.
    - Confirm Cloudflare **Deployments** builds the published `main` commit when a push occurred.
    - Do not edit deployment files or rely on GitHub **Sync fork** for routine upgrades; the workflow is the only synchronization path needed by a normal deployment Fork. Use **Sync fork** once only when an old Fork must receive a newer updater workflow itself, then return to **Update deployed EdgeEver**.
+
+## Optional: Customize the Initial Administrator Username
+
+Ordinary deployments use the default username `admin`; do not proactively ask the user whether to change it. Only when the user explicitly requests a custom administrator username, set `EDGE_EVER_AUTH_USERNAME` in Workers Builds variables before the first build and use that username during login verification. Changing only this variable after the administrator account exists does not rename that account.

docs/agent-deploy-cloudflare.zh-CN.md

@@ -11,20 +11,16 @@
 1. **Fork 仓库**
    - Fork `tianma-if/edgeever` 到目标 GitHub 账户。
 
-2. **启用工作流**
-   - 在 Fork 仓库的 **Actions** 标签页中，启用 **Update deployed EdgeEver** 自动更新工作流（公共 Fork 上定时任务默认关闭，必须手动启用）。
-   - 普通 Fork 默认作为部署镜像，无需配置任何更新变量：工作流会把所选上游 Release 的产品代码快照应用到 `main`，再触发 Cloudflare。
-   - 更新器会把 Fork 自己的完整 `.github/workflows/**` 目录及两个更新辅助脚本作为稳定的本地引导层保留。官方打包、签名、测试与 Release 工作流继续通过 `tianma-if/edgeever` 仓库门禁限制执行，也不会被下游产品更新改写。
-   - 只有明确维护了应用代码修改的 Fork，才应创建 Actions 仓库变量 `EDGE_EVER_PRESERVE_FORK_CHANGES=true`。启用后改为 merge，并由仓库所有者处理未来冲突；普通部署无需设置。
+2. **创建 Cloudflare 资源**
+   - 创建名称严格为 `edgeever` 的 D1 数据库。
+   - 创建名称严格为 `edgeever-resources` 的 R2 存储桶。
 
 3. **Cloudflare 项目导入**
    - 登录 Cloudflare **Workers & Pages** 控制台，导入该 Fork 仓库。
    - 配置项目使用仓库根目录、生产环境 `main` 分支，并读取仓库根目录下的 `wrangler.toml`。
 
-4. **资源与凭据 (Resources & Secrets)**
-   - 创建名称严格为 `edgeever` 的 D1 数据库。
-   - 创建名称严格为 `edgeever-resources` 的 R2 存储桶。
-   - **Worker Secret**：添加密钥 `EDGE_EVER_AUTH_PASSWORD`，值为初始管理员登录密码。
+4. **配置登录凭据与实例参数**
+   - **Worker Secret**：添加密钥 `EDGE_EVER_AUTH_PASSWORD`，值为初始管理员登录密码；建议使用至少 32 个字符且仅用于此实例的强密码。
    - 该密码只配置为 Worker 运行时 Secret，不要复制到 Workers Builds 构建变量；标准部署入口会复用并验证已存在的 Secret。
    - 不要修改 `wrangler.toml`，也不要在控制台重复添加 binding。部署命令会根据标准资源名称生成 `DB` 与 `RESOURCES` binding。
    - 对按旧版文档部署的已有 Worker，不要要求用户重命名或重新配置自定义 R2 存储桶。没有显式覆盖时，部署会自动保留线上 `RESOURCES` binding 与管理员用户名。
@@ -44,10 +40,18 @@
    - 触发启动首次构建，待构建部署完成后，进行如下自动化验证：
      - 检查 `https://<你的 Worker 域名>/api/health` 返回 `200` 状态码且 JSON 内容为 `{"ok": true}`。
      - 检查 `https://<你的 Worker 域名>/api/openapi.json` 能够正常加载 OpenAPI 规范。
-     - 使用用户名 `admin` 和 `EDGE_EVER_AUTH_PASSWORD` 验证登录 API；若高级部署设置了 `EDGE_EVER_AUTH_USERNAME` 构建变量，则改用对应用户名。
+     - 使用用户名 `admin` 和 `EDGE_EVER_AUTH_PASSWORD` 验证登录 API。
 
 7. **验证上游更新通道**
+   - 在 Fork 仓库的 **Actions** 标签页中启用 **Update deployed EdgeEver**（公共 Fork 上定时任务默认关闭，必须手动启用）。
+   - 普通 Fork 默认作为部署镜像，无需配置任何更新变量：工作流会把所选上游 Release 的产品代码快照应用到 `main`，再触发 Cloudflare。
+   - 更新器会把 Fork 自己的完整 `.github/workflows/**` 目录及两个更新辅助脚本作为稳定的本地引导层保留。官方打包、签名、测试与 Release 工作流继续通过 `tianma-if/edgeever` 仓库门禁限制执行，也不会被下游产品更新改写。
+   - 只有明确维护了应用代码修改的 Fork，才应创建 Actions 仓库变量 `EDGE_EVER_PRESERVE_FORK_CHANGES=true`。启用后改为 merge，并由仓库所有者处理未来冲突；普通部署无需设置。
    - 在 Fork 的 **Actions** 中手动运行一次 **Update deployed EdgeEver**。即使 Fork 已对齐，手动运行也会重新发布所选版本，确保 Cloudflare 收到新的构建事件。
    - 打开 Job **Summary**，确认 Fork mode 为 `mirror`，并显示上游目标（stable Release 或 edge `main`），以及「已发布更新」或明确的「已对齐」结果。
    - 若发生了 push，确认 Cloudflare **Deployments** 构建的是对应的 `main` commit。
    - 普通部署 Fork 不应修改部署文件，日常升级也不要依赖 GitHub **Sync fork**；本工作流就是唯一需要的同步路径。只有旧 Fork 必须取得新版更新工作流本身时，才使用一次 **Sync fork**，之后继续使用 **Update deployed EdgeEver**。
+
+## 可选：自定义初始管理员用户名
+
+普通部署直接使用默认用户名 `admin`，不要主动询问用户是否需要修改。仅当用户明确要求自定义管理员用户名时，才在首次构建前通过 Workers Builds 构建变量设置 `EDGE_EVER_AUTH_USERNAME`，并在登录验证时使用该用户名。管理员账号已创建后，仅修改该变量不会重命名现有账号。

docs/deploy-cloudflare-button.md

@@ -15,11 +15,10 @@ This document provides a detailed step-by-step guide for deploying EdgeEver onli
 
 ## Step-by-Step Deployment Guide
 
-### Step 1: Fork the Repository & Enable Actions
+### Step 1: Fork the Repository
 
 1. Visit the official EdgeEver repository: `https://github.com/tianma-if/edgeever`.
 2. Click the **Fork** button at the top right to fork the repository into your GitHub account.
-3. Go to your Forked repository, navigate to the **Actions** tab, and click **"I understand my workflows, go ahead and enable them"** to activate automated workflows.
 
 ---
 
@@ -36,20 +35,13 @@ Log into your [Cloudflare Dashboard](https://dash.cloudflare.com/):
 
 ---
 
-### Step 3: Import Project & Configure the Login Secret
+### Step 3: Import the Project
 
 1. In Cloudflare Dashboard, navigate to **Workers & Pages** -> **Overview**, click **Create application** -> **Pages** / **Workers** (Import Git Repository).
 2. Click **Connect to Git**, authorize Cloudflare, and select your Forked `edgeever` repository.
 3. Project settings:
    - **Production branch**: `main`
    - **Root directory**: Leave blank or default `/`
-4. Under **Settings** -> **Variables and Secrets**, add the login password:
-
-| Type | Name | Value | Purpose |
-| :--- | :--- | :--- | :--- |
-| **Secret** | `EDGE_EVER_AUTH_PASSWORD` | Set a strong admin password | Initial login credential |
-
-> `EDGE_EVER_AUTH_PASSWORD` is a Worker runtime Secret, not a Workers Builds variable. The standard deploy command reuses and verifies this Secret; do not duplicate the password in build variables.
 
 The repository's deployment command creates the `DB` and `RESOURCES` bindings from the standard resource names. Do not edit `wrangler.toml` or add duplicate bindings in the Dashboard.
 
@@ -57,7 +49,19 @@ Existing deployments created from older instructions do not need to rename or mi
 
 ---
 
-### Step 4: Start the Build
+### Step 4: Set the Administrator Password
+
+Under the Worker's **Settings** -> **Variables and Secrets**, add this Secret:
+
+| Type | Name | Value | Purpose |
+| :--- | :--- | :--- | :--- |
+| **Secret** | `EDGE_EVER_AUTH_PASSWORD` | Preferably at least 32 characters and unique to this instance | Administrator login password |
+
+`EDGE_EVER_AUTH_PASSWORD` is the variable name; the Secret value is the administrator login password you choose. It is a Worker runtime Secret, not a Workers Builds variable, so do not duplicate the password in build variables.
+
+---
+
+### Step 5: Start the Build
 
 Keep the default deploy command filled in by Cloudflare:
 
@@ -80,7 +84,7 @@ After publishing, the CI deployment records the actual public target reported by
 
 ---
 
-### Step 5: Verify Deployment & Login
+### Step 6: Verify Deployment, Login & Automatic Updates
 
 1. After deployment completes, Cloudflare will assign a default domain (e.g., `https://edgeever.your-subdomain.workers.dev`).
 2. Visit the health check endpoint in your browser: `https://<your-domain>/api/health`, and confirm it returns HTTP `200` with:
@@ -88,7 +92,8 @@ After publishing, the CI deployment records the actual public target reported by
    { "ok": true }
    ```
 3. Open the homepage, log in with your configured administrator username (default: `admin`) and `EDGE_EVER_AUTH_PASSWORD`, and start using EdgeEver!
-4. Go back to your Fork's **Actions** tab on GitHub and manually trigger **Update deployed EdgeEver** once to ensure upstream updates will sync properly in the future.
+4. Go back to your Fork's **Actions** tab on GitHub and click **I understand my workflows, go ahead and enable them**.
+5. Manually run **Update deployed EdgeEver** once to ensure future upstream updates can sync, and confirm Cloudflare receives the resulting build event.
 
 ---
 
@@ -117,6 +122,8 @@ Ordinary deployments do not need these settings. To customize an instance, add n
 | `EDGE_EVER_WORKERS_DEV` | Enable or disable the `workers.dev` route |
 | `EDGE_EVER_CUSTOM_DOMAIN` / `EDGE_EVER_ROUTE_PATTERN` | Custom routing |
 
+To customize the initial administrator username, set `EDGE_EVER_AUTH_USERNAME` before the first build. Ordinary deployments need no configuration and can use the default username `admin`. Changing only this variable after the administrator account exists does not rename that account.
+
 Passwords and other credentials remain Worker runtime Secrets and must never be added to Builds variables. An advanced local deployment may instead use the git-ignored `.env.local` or an external `WRANGLER_CONFIG` file.
 
 ---

docs/deploy-cloudflare-button.zh-CN.md

@@ -15,11 +15,10 @@
 
 ## 首次部署图文指南
 
-### 步骤 1：Fork 仓库并开启 Actions
+### 步骤 1：Fork 仓库
 
 1. 访问 EdgeEver 官方仓库：`https://github.com/tianma-if/edgeever`。
 2. 点击右上角 **Fork** 按钮，将仓库 Fork 到您的个人 GitHub 账户下。
-3. 进入您 Fork 后的仓库，切换到 **Actions** 标签页，点击 **"I understand my workflows, go ahead and enable them"** 启用自动化工作流。
 
 ---
 
@@ -36,20 +35,13 @@
 
 ---
 
-### 步骤 3：导入项目并配置登录 Secret
+### 步骤 3：导入项目
 
 1. 在 Cloudflare 控制台中，进入 **Workers & Pages** -> **Overview**，点击 **Create application** -> **Pages** / **Workers** (选择导入 Git 仓库)。
 2. 选择 **Connect to Git**，授权并选中您刚才 Fork 的 `edgeever` 仓库。
 3. 在项目设置中：
    - **Production branch**：选择 `main`
    - **Root directory**：保持留空或默认 `/`
-4. 在 **Settings** -> **Variables and Secrets** 中添加登录密码：
-
-| 类型 (Type) | 名称 (Name) | 值 (Value) | 说明 |
-| :--- | :--- | :--- | :--- |
-| **Secret** | `EDGE_EVER_AUTH_PASSWORD` | 设置一个高强度管理员密码 | 初始登录凭据 |
-
-> `EDGE_EVER_AUTH_PASSWORD` 是 Worker 运行时 Secret，不是 Workers Builds 构建变量。标准部署命令会复用并验证这个 Secret；无需、也不应把密码重复填写到构建变量中。
 
 仓库中的部署命令会根据标准资源名称生成 `DB` 与 `RESOURCES` binding。不要修改 `wrangler.toml`，也不要在控制台中重复添加 binding。
 
@@ -57,7 +49,19 @@
 
 ---
 
-### 步骤 4：启动构建
+### 步骤 4：设置管理员密码
+
+在 Worker 的 **Settings** -> **Variables and Secrets** 中添加以下 Secret：
+
+| 类型 (Type) | 名称 (Name) | 值 (Value) | 说明 |
+| :--- | :--- | :--- | :--- |
+| **Secret** | `EDGE_EVER_AUTH_PASSWORD` | 建议至少 32 个字符且仅用于此实例的强密码 | 管理员登录密码 |
+
+`EDGE_EVER_AUTH_PASSWORD` 是变量名，Secret 的值才是您自行设置的管理员登录密码。它属于 Worker 运行时 Secret，不是 Workers Builds 构建变量；无需、也不应把密码重复填写到构建变量中。
+
+---
+
+### 步骤 5：启动构建
 
 保留 Cloudflare 自动填写的默认部署命令：
 
@@ -80,7 +84,7 @@ Deploy command: bun run deploy:cloudflare-builds
 
 ---
 
-### 步骤 5：验证部署与登录
+### 步骤 6：验证部署、登录与自动更新
 
 1. 构建完成后，Cloudflare 会为您生成一个二级域名（如 `https://edgeever.your-subdomain.workers.dev`）。
 2. 在浏览器打开该域名下的健康检查接口：`https://你的域名/api/health`，确认返回 `200` 及 JSON：
@@ -88,7 +92,8 @@ Deploy command: bun run deploy:cloudflare-builds
    { "ok": true }
    ```
 3. 打开主站首页，输入您配置的管理员用户名（默认是 `admin`）和密码（`EDGE_EVER_AUTH_PASSWORD`）测试登录并开始使用。
-4. 返回 Fork 的 GitHub 仓库 **Actions** 页面，手动触发运行一次 **Update deployed EdgeEver** 工作流，确保未来可自动跟进上游更新。
+4. 返回 Fork 的 GitHub 仓库 **Actions** 页面，点击 **I understand my workflows, go ahead and enable them** 启用工作流。
+5. 手动运行一次 **Update deployed EdgeEver**，确保未来可自动跟进上游更新，并确认 Cloudflare 收到这次构建事件。
 
 ---
 
@@ -117,6 +122,8 @@ EDGE_EVER_UPDATE_CHANNEL=edge
 | `EDGE_EVER_WORKERS_DEV` | 启用或禁用 `workers.dev` 路由 |
 | `EDGE_EVER_CUSTOM_DOMAIN` / `EDGE_EVER_ROUTE_PATTERN` | 自定义路由 |
 
+如需自定义初始管理员用户名，请在首次构建前设置 `EDGE_EVER_AUTH_USERNAME`。普通部署无需配置，直接使用默认用户名 `admin` 即可；管理员账号已创建后，仅修改该变量不会重命名现有账号。
+
 密码及其他凭据始终属于 Worker 运行时 Secret，绝不能放入 Builds 构建变量。高级本地部署也可以使用被 Git 忽略的 `.env.local`，或仓库外部的 `WRANGLER_CONFIG` 文件。
 
 ---