diff --git a/scripts/deploy-from-workstation.ps1 b/scripts/deploy-from-workstation.ps1
index 2021b1d3..a21b060e 100644
--- a/scripts/deploy-from-workstation.ps1
+++ b/scripts/deploy-from-workstation.ps1
@@ -32,6 +32,7 @@ $authSession = $null
 $sshOptions = @()
 $scpOptions = @()
 if ($IsMacOS) { $scpOptions += '-O' }
+$sshControlPath = if ($IsMacOS) { "/tmp/caiwu-ssh-$PID-$([Guid]::NewGuid().ToString('N')).sock" } else { $null }
 $sshTarget = "${SshUser}@${Server}"
 $imageName = 'caiwu_akaunting'
 $targetPlatform = 'linux/amd64'
@@ -344,8 +345,10 @@ try {
 
     $authSession = Start-CaiwuDeploymentAuth -Server $Server -SshUser $SshUser -KeyPath $KeyPath -Password $Password -UpdatePassword:$UpdatePassword
     $sshOptions = $authSession.Options
-    & ssh @sshOptions $sshTarget true
-    if ($LASTEXITCODE -ne 0) { throw '服务器登录失败或已取消，已停止部署。若密码已变更，由 Codex 使用 -UpdatePassword 重新打开本机密码窗口。' }
+    if ($sshControlPath) {
+        $sshOptions += @('-o', 'ControlMaster=auto', '-o', 'ControlPersist=600', '-o', "ControlPath=$sshControlPath")
+    }
+    Invoke-NativeWithRetry { ssh @sshOptions $sshTarget true } '服务器登录失败或已取消，已停止部署。' -Attempts 3
     if ($authSession.Directory) { $env:CAIWU_DEPLOY_PASSWORD_UPDATE = $null }
     $remoteArchive = "$RemotePath/image-$imageTag.tar.gz"
 
@@ -608,6 +611,10 @@ finally {
             ssh @sshOptions -o ConnectTimeout=5 $sshTarget "rm -f '$bootstrapRemote'" 2>$null | Out-Null
         }
 
+        if ($sshControlPath) {
+            ssh @sshOptions -O exit $sshTarget 2>$null | Out-Null
+        }
+
         # Keep the compiled PHP base and Composer vendor layers between releases.
         # The production build cache is normally about 20 GB; pruning it to 3 GB made
         # every deployment rebuild PHP extensions and download all dependencies again.