diff --git a/scripts/deploy-from-workstation.ps1 b/scripts/deploy-from-workstation.ps1
index a91f7445..7133c053 100644
--- a/scripts/deploy-from-workstation.ps1
+++ b/scripts/deploy-from-workstation.ps1
@@ -227,6 +227,7 @@ function Start-RegistryTunnel {
         '-o', 'ConnectTimeout=10',
         '-o', 'ExitOnForwardFailure=yes',
         '-o', 'ServerAliveInterval=15',
+        '-o', 'ServerAliveCountMax=20',
         '-L', "127.0.0.1:${LocalPort}:127.0.0.1:5000",
         $sshTarget
     )) {
@@ -424,11 +425,45 @@ try {
         $beforeBytesOutput = @(& ssh -i $keyFullPath -o BatchMode=yes $sshTarget "du -sb /var/lib/docker-registry 2>/dev/null | cut -f1")
         $beforeBytes = [long](($beforeBytesOutput -join '').Trim())
         $uploadTimer = [Diagnostics.Stopwatch]::StartNew()
-        Invoke-Native {
-            & $regctlPath `
-                --host "reg=127.0.0.1:${localRegistryPort},tls=disabled" `
-                image import $registryImage $localTar
-        } '增量镜像层上传失败。'
+        $uploadSucceeded = $false
+        for ($uploadAttempt = 1; $uploadAttempt -le 2; $uploadAttempt++) {
+            if ($uploadAttempt -gt 1) {
+                if ($sshTunnel) {
+                    if (-not $sshTunnel.HasExited) {
+                        $sshTunnel.Kill()
+                        $sshTunnel.WaitForExit()
+                    }
+                    $sshTunnel.Dispose()
+                }
+
+                $localRegistryPort = Get-AvailableLocalPort
+                $sshTunnel = Start-RegistryTunnel -LocalPort $localRegistryPort
+                $registryImage = "127.0.0.1:${localRegistryPort}/caiwuxitong/app:$imageTag"
+            }
+
+            if ($sshTunnel.HasExited) {
+                $uploadExitCode = 255
+            }
+            else {
+                & $regctlPath `
+                    --host "reg=127.0.0.1:${localRegistryPort},tls=disabled" `
+                    image import $registryImage $localTar
+                $uploadExitCode = $LASTEXITCODE
+            }
+
+            if ($uploadExitCode -eq 0) {
+                $uploadSucceeded = $true
+                break
+            }
+
+            if ($uploadAttempt -eq 1) {
+                Write-Warning '增量镜像隧道在上传期间中断，正在重新建立隧道并重试一次。'
+            }
+        }
+
+        if (-not $uploadSucceeded) {
+            throw '增量镜像层上传失败。'
+        }
         $uploadTimer.Stop()
         $afterBytesOutput = @(& ssh -i $keyFullPath -o BatchMode=yes $sshTarget "du -sb /var/lib/docker-registry 2>/dev/null | cut -f1")
         $afterBytes = [long](($afterBytesOutput -join '').Trim())