diff --git a/scripts/git-incremental-deploy.ps1 b/scripts/git-incremental-deploy.ps1
index cadc4af..0f2bf5a 100644
--- a/scripts/git-incremental-deploy.ps1
+++ b/scripts/git-incremental-deploy.ps1
@@ -1508,6 +1508,7 @@ const expectedMigrationNames = new Set([
   '20260826_add_pack_video_early_access',
   '20260828_add_pack_item_can_edit_assets',
   '20260828_add_task_detail_change_approvals',
+  '20260829_add_recoverable_api_key_secret',
 ]);
 if (migrations.length !== expectedMigrationNames.size
   || migrations.some((item) => !expectedMigrationNames.has(item && item.name)
diff --git a/scripts/safe-production-migrate.test.mjs b/scripts/safe-production-migrate.test.mjs
index defae0c..b88ad7e 100644
--- a/scripts/safe-production-migrate.test.mjs
+++ b/scripts/safe-production-migrate.test.mjs
@@ -563,7 +563,7 @@ test('target evidence rejects nullable logo columns and structurally wrong index
 })
 
 test('container supply chain and migrator image are immutable while SOP keeps complete gates', async () => {
-  const [dockerfile, sop, incidentSop, migratorSource, backupSource, uploadIdMigration, dockerIgnore] = await Promise.all([
+  const [dockerfile, sop, incidentSop, migratorSource, backupSource, uploadIdMigration, dockerIgnore, deploymentSource] = await Promise.all([
     readFile(new URL('../Dockerfile', import.meta.url), 'utf8'),
     readFile(new URL('../docs/生产数据库安全增量迁移SOP-2026-08-12.md', import.meta.url), 'utf8'),
     readFile(new URL('../docs/视频预览任务中断事故复盘-2026-08-11.md', import.meta.url), 'utf8'),
@@ -571,6 +571,7 @@ test('container supply chain and migrator image are immutable while SOP keeps co
     readFile(new URL('./create-verified-production-backup.mjs', import.meta.url), 'utf8'),
     readFile(new URL('../prisma/migrations/20260812_align_material_upload_idempotency_index/migration.sql', import.meta.url), 'utf8'),
     readFile(new URL('../.dockerignore', import.meta.url), 'utf8'),
+    readFile(new URL('./git-incremental-deploy.ps1', import.meta.url), 'utf8'),
   ])
   const migratorStart = dockerfile.indexOf('FROM base AS migrator')
   const runnerStart = dockerfile.indexOf('FROM base AS runner', migratorStart)
@@ -630,6 +631,7 @@ test('container supply chain and migrator image are immutable while SOP keeps co
   }
   assert.match(dockerfile, /20260829_add_recoverable_api_key_secret/)
   assert.match(migratorSource, /'20260829_add_recoverable_api_key_secret'/)
+  assert.match(deploymentSource, /'20260829_add_recoverable_api_key_secret'/)
   assert.ok(sop.includes('`20260829_add_recoverable_api_key_secret`'))
   assert.match(backupSource, /'--format=custom'/)
   assert.match(backupSource, /'--serializable-deferrable'/)