diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index e19926a0..700b9c46 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -89,10 +89,16 @@ jobs:
           # no pre-commit). Probe the same order as scripts/ci_local.py:
           #   PATH python -> .venv -> anaconda3
           #
-          # CAUTION: a failing native command writes to stderr; with
+          # CAUTION 1: a failing native command writes to stderr; with
           # $ErrorActionPreference='Stop' that would abort the whole script
           # (NativeCommandError) before the next candidate is tried. So relax
           # the preference around each probe, and restore it afterwards.
+          #
+          # CAUTION 2: pre-commit may be installed in the USER site of some
+          # account (e.g. %APPDATA%\Roaming\Python\...), which SYSTEM cannot
+          # see at all -- no python.exe path can help then. Probe with `-s`
+          # (no user-site) so we only accept an interpreter that works for
+          # SYSTEM, and say so clearly when none is found.
           $candidates = @(
             (Get-Command python -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Source),
             (Join-Path $repoRoot '.venv\Scripts\python.exe'),
@@ -104,19 +110,21 @@ jobs:
             if (-not $c) { continue }
             if (-not (Test-Path $c)) { continue }
             $ErrorActionPreference = 'Continue'
-            & $c -m pre_commit --version 2>&1 | Out-Null
+            & $c -s -m pre_commit --version 2>&1 | Out-Null
             $rc = $LASTEXITCODE
             $ErrorActionPreference = $saved
             if ($rc -eq 0) { $py = $c; break }
           }
           $ErrorActionPreference = 'Stop'
           if (-not $py) {
-            Write-Host "::error::no Python with pre-commit found. Tried: $($candidates -join ' | ')"
+            Write-Host "::error::no Python with a SYSTEM-visible pre-commit. Tried: $($candidates -join ' | ')"
+            Write-Host "::error::pre-commit is probably installed only in a USER site (invisible to SYSTEM)."
+            Write-Host "::error::fix (elevated): powershell -ExecutionPolicy Bypass -File D:\Docker\act_runner\install_precommit_global.ps1"
             exit 1
           }
           Write-Host "using python: $py"
           & $py --version
-          & $py -m pre_commit --version
+          & $py -s -m pre_commit --version
           "PYTHON=$py" | Out-File -FilePath $env:GITHUB_ENV -Append
 
           # --- cppcheck -----------------------------------------------------
@@ -140,7 +148,7 @@ jobs:
 
       - name: 安装 pre-commit 钩子到本仓库
         shell: powershell
-        run: "& $env:PYTHON -m pre_commit install --install-hooks"
+        run: "& $env:PYTHON -s -m pre_commit install --install-hooks"
 
       - name: 决定跳过哪些钩子（Keil 依赖）
         id: skip
@@ -163,7 +171,7 @@ jobs:
           SKIP: ${{ steps.skip.outputs.value }}
         run: |
           if ($env:SKIP) { Write-Host "SKIP=$env:SKIP" }
-          & $env:PYTHON -m pre_commit run --all-files --show-diff-on-failure
+          & $env:PYTHON -s -m pre_commit run --all-files --show-diff-on-failure
           if ($LASTEXITCODE -ne 0) {
             Write-Host "::error::L0 static gates failed (see output above)"
             exit $LASTEXITCODE