diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e8bff81..d2fd0ac 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,10 +25,6 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
-  # The self-hosted act_runner network can terminate index.crates.io with a
-  # certificate that does not match the sparse-index hostname. Use Cargo's git
-  # index path in CI; GitHub access is already required for the actions above.
-  CARGO_REGISTRIES_CRATES_IO_PROTOCOL: git
 
 jobs:
   build-test:
@@ -78,6 +74,16 @@ jobs:
           echo "Resolved LIBCLANG_PATH=$LIBDIR (found $LIBCL)"
           echo "LIBCLANG_PATH=$LIBDIR" >> "$GITHUB_ENV"
 
+      - name: Configure cargo mirror (CI-only)
+        run: |
+          mkdir -p ~/.cargo
+          cat > ~/.cargo/config.toml <<'EOF'
+          [source.crates-io]
+          replace-with = "rsproxy-sparse"
+          [source.rsproxy-sparse]
+          registry = "sparse+https://rsproxy.cn/index/"
+          EOF
+
       - name: Cache cargo registry + build artifacts
         uses: https://gitea.com/actions/cache@v4
         with:
@@ -109,6 +115,16 @@ jobs:
       - name: Install Rust toolchain (stable)
         run: rustup toolchain install stable --profile minimal && rustup default stable
 
+      - name: Configure cargo mirror (CI-only)
+        run: |
+          mkdir -p ~/.cargo
+          cat > ~/.cargo/config.toml <<'EOF'
+          [source.crates-io]
+          replace-with = "rsproxy-sparse"
+          [source.rsproxy-sparse]
+          registry = "sparse+https://rsproxy.cn/index/"
+          EOF
+
       - name: Install cargo-audit
         run: cargo install cargo-audit --locked