diff --git a/deploy/README.md b/deploy/README.md
index cd790d8..4b90255 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -1,6 +1,6 @@
 # Arcticnewone 生产部署配置
 
-本目录存放 Arcticnewone 个人网站的 Kubernetes 生产部署配置（华为云 SWR 镜像 + Traefik Ingress）。
+本目录存放 Arcticnewone 个人网站的 Kubernetes 生产部署配置（华为云 SWR 镜像 + Traefik Ingress）。所有资源统一部署在 `arcticnewone` 命名空间中。
 
 ## 文件说明
 
@@ -10,16 +10,19 @@
 | `service.yaml` | Service：ClusterIP，80 端口转发到容器 3000 端口 |
 | `ingress.yaml` | Ingress：域名 `personal.virtheart.com`，Traefik + cert-manager 自动签发证书 |
 
+三个 YAML 的 `metadata` 均已指定 `namespace: arcticnewone`。
+
 ## 部署前置条件
 
 1. 镜像已构建并推送到华为云 SWR：
    `swr.cn-north-4.myhuaweicloud.com/virtheart/arcticnewone:latest`（多架构 `linux/amd64,linux/arm64`，tag 统一为 `latest`）
 2. 集群已安装 Traefik Ingress 与 cert-manager（ClusterIssuer 名称为 `lets-encrypt`）
 3. 域名 `personal.virtheart.com` 的 DNS 已解析到集群入口
-4. 创建私有镜像拉取 Secret（凭据从环境变量读取，绝不写入仓库）：
+4. 创建命名空间与私有镜像拉取 Secret（凭据从环境变量读取，绝不写入仓库）：
 
    ```bash
-   kubectl create secret docker-registry huawei-swr-secret \
+   kubectl create namespace arcticnewone
+   kubectl create secret docker-registry huawei-swr-secret -n arcticnewone \
      --docker-server="$SWR_REGISTRY" \
      --docker-username="$SWR_USERNAME" \
      --docker-password="$SWR_PASSWORD" \
@@ -34,11 +37,13 @@ kubectl apply -f deploy/service.yaml
 kubectl apply -f deploy/ingress.yaml
 ```
 
+三个 YAML 自带 `namespace: arcticnewone`，`kubectl apply` 时无需额外指定。
+
 部署后验证：
 
 ```bash
-kubectl get deploy,svc,ingress
-kubectl rollout status deployment/arcticnewone
+kubectl get deploy,svc,ingress -n arcticnewone
+kubectl rollout status deployment/arcticnewone -n arcticnewone
 curl -I https://personal.virtheart.com
 ```
 
@@ -48,10 +53,10 @@ curl -I https://personal.virtheart.com
 
 ```bash
 # 回滚到上一版本镜像
-kubectl rollout undo deployment/arcticnewone
+kubectl rollout undo deployment/arcticnewone -n arcticnewone
 
 # 或整体移除本次部署的资源
-kubectl delete -f deploy/ingress.yaml
-kubectl delete -f deploy/service.yaml
-kubectl delete -f deploy/deployment.yaml
+kubectl delete -f deploy/ingress.yaml -n arcticnewone
+kubectl delete -f deploy/service.yaml -n arcticnewone
+kubectl delete -f deploy/deployment.yaml -n arcticnewone
 ```
diff --git a/deploy/deployment.yaml b/deploy/deployment.yaml
index 9e59830..d3ccb80 100644
--- a/deploy/deployment.yaml
+++ b/deploy/deployment.yaml
@@ -17,6 +17,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: arcticnewone
+  namespace: arcticnewone
   labels:
     app: arcticnewone
 spec:
diff --git a/deploy/ingress.yaml b/deploy/ingress.yaml
index e81e591..5d44b3e 100644
--- a/deploy/ingress.yaml
+++ b/deploy/ingress.yaml
@@ -8,6 +8,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: arcticnewone-ingress
+  namespace: arcticnewone
   annotations:
     cert-manager.io/cluster-issuer: "lets-encrypt"
 spec:
diff --git a/deploy/service.yaml b/deploy/service.yaml
index 15e2d52..a47185b 100644
--- a/deploy/service.yaml
+++ b/deploy/service.yaml
@@ -8,6 +8,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: arcticnewone-svc
+  namespace: arcticnewone
   labels:
     app: arcticnewone
 spec: