diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 2b7a582..a7d3b0f 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -2,7 +2,7 @@ name: Docker Build
 
 on:
   push:
-    branches: [main]
+    branches: [main, dev]
     tags: ["v*"]
   workflow_dispatch:
 
@@ -30,6 +30,7 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
             type=sha,format=long
             type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+            type=raw,value=dev,enable=${{ github.ref == 'refs/heads/dev' }}
 
       - name: Login to GHCR
         uses: docker/login-action@v3
@@ -66,6 +67,7 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
             type=sha,format=long
             type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+            type=raw,value=dev,enable=${{ github.ref == 'refs/heads/dev' }}
 
       - name: Push to Docker Hub
         if: steps.login_dh.outcome == 'success'
diff --git a/deploy/README.en.md b/deploy/README.en.md
index 576b417..222e1c6 100644
--- a/deploy/README.en.md
+++ b/deploy/README.en.md
@@ -66,6 +66,10 @@ Access `https://<domain-or-IP>/`. Nginx terminates TLS on 443 (your cert), proxi
 
 ### T4 (Nginx + acme.sh Auto)
 
+**Certificate separation design:**
+- nginx 443: uses `certs/ego.crt` + `ego.key` (Let's Encrypt certificate)
+- EGo 5001: uses `certs/ego-selfsigned.crt` + `ego-selfsigned.key` (self-signed certificate)
+
 **One-click deployment:**
 
 ```bash
@@ -94,7 +98,7 @@ docker compose exec acme acme.sh --issue --webroot /var/www/acme -d your.domain
 CF_Token=your_token docker compose up -d
 docker compose exec acme acme.sh --issue --dns dns_cf -d your.domain --server letsencrypt
 
-# Copy certificates to correct location
+# Copy certificates to correct location (Let's Encrypt cert for nginx)
 docker compose exec acme cp /acme.sh/your.domain/fullchain.cer /certs/ego.crt
 docker compose exec acme cp /acme.sh/your.domain/your.domain.key /certs/ego.key
 ```
diff --git a/deploy/README.md b/deploy/README.md
index 4adc843..5d6716b 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -67,6 +67,10 @@ docker compose up -d
 
 ### T4（Nginx + acme.sh 自动证书）
 
+**证书分离设计：**
+- nginx 443: 使用 `certs/ego.crt` + `ego.key`（Let's Encrypt 证书）
+- EGo 5001: 使用 `certs/ego-selfsigned.crt` + `ego-selfsigned.key`（自签名证书）
+
 **一键部署：**
 
 ```bash
@@ -95,7 +99,7 @@ docker compose exec acme acme.sh --issue --webroot /var/www/acme -d your.domain
 CF_Token=your_token docker compose up -d
 docker compose exec acme acme.sh --issue --dns dns_cf -d your.domain --server letsencrypt
 
-# 复制证书到正确位置
+# 复制证书到正确位置（Let's Encrypt 证书给 nginx）
 docker compose exec acme cp /acme.sh/your.domain/fullchain.cer /certs/ego.crt
 docker compose exec acme cp /acme.sh/your.domain/your.domain.key /certs/ego.key
 ```
diff --git a/deploy/init.sh b/deploy/init.sh
index 7db3d40..1feb022 100644
--- a/deploy/init.sh
+++ b/deploy/init.sh
@@ -146,6 +146,10 @@ case $DEPLOY_DIR in
             cp "$HOME/.acme.sh/$DOMAIN/fullchain.cer" certs/ego.crt
             cp "$HOME/.acme.sh/$DOMAIN/$DOMAIN.key" certs/ego.key
         fi
+        
+        # 生成自签名证书给 EGo 5001 端口使用
+        echo "生成自签名证书给 EGo..."
+        openssl req -x509 -newkey rsa:2048 -keyout certs/ego-selfsigned.key -out certs/ego-selfsigned.crt -days 365 -nodes -subj "/CN=$DOMAIN"
         ;;
 esac
 
diff --git a/deploy/t4-certbot/docker-compose.yml b/deploy/t4-certbot/docker-compose.yml
index 7c22e92..1f917ae 100644
--- a/deploy/t4-certbot/docker-compose.yml
+++ b/deploy/t4-certbot/docker-compose.yml
@@ -1,6 +1,10 @@
 # T4 — 懒人全自动（bridge + Nginx + acme.sh，Let's Encrypt）
 # 场景：个人 / 小团队云端，拥有公网域名。自动签发并续期免费证书。
 #
+# 证书分离设计：
+#   - nginx 443: 使用 certs/ego.crt + ego.key（Let's Encrypt 证书）
+#   - EGo 5001:  使用 certs/ego-selfsigned.crt + ego-selfsigned.key（自签名证书）
+#
 # 默认使用 webroot 模式（需要 80 端口），也支持 Cloudflare DNS API 验证。
 #
 # 方式一：webroot 模式（默认，需要域名解析到本机公网 IP）
@@ -23,7 +27,9 @@ services:
       - WEB_SSL_PORT=5001
       - DB_PATH=/app/data/ego.db
       - LOG_LEVEL=INFO
-      - EGO_SSL_DIR=/app/certs
+      - EGO_SSL_CERT=/app/certs/ego-selfsigned.crt
+      - EGO_SSL_KEY=/app/certs/ego-selfsigned.key
+      - EGO_SECRET_KEY=${EGO_SECRET_KEY:-}
     volumes:
       - ego_data:/app/data
       - ego_config:/app/config
diff --git a/deploy/t4-certbot/nginx.conf b/deploy/t4-certbot/nginx.conf
index f2ab236..587eaca 100644
--- a/deploy/t4-certbot/nginx.conf
+++ b/deploy/t4-certbot/nginx.conf
@@ -1,5 +1,7 @@
 # T4 Nginx — Let's Encrypt（acme.sh webroot 自动续期）
-# 证书统一放在本目录 certs/ego.crt 与 certs/ego.key，与 T3 一致。
+# 证书分离设计：
+#   - nginx 443: 使用 certs/ego.crt + ego.key（Let's Encrypt 证书）
+#   - EGo 5001:  使用 certs/ego-selfsigned.crt + ego-selfsigned.key（自签名证书）
 # 首次签发后需把证书复制到 certs/ 目录（见 docker-compose 注释）。
 # 把所有 your.domain 改成你的域名。
 
diff --git a/web_ui.py b/web_ui.py
index 1be152c..5c499ec 100644
--- a/web_ui.py
+++ b/web_ui.py
@@ -63,13 +63,25 @@ def run_web_ui(port: int = 5000, ssl_port: int = 5001):
     """由 main.py 调用，启动 Flask 开发服务器。
 
     - 有证书：HTTP 跑在 `port`（webhook/健康检查），HTTPS 跑在 `ssl_port`（管理页面）。
-    - 无证书：仅 HTTP 跑在 `port`，并告警。
+    - 无证书：HTTP 跑在 `port`（webhook/健康检查），HTTP 也跑在 `ssl_port`（管理页面，不加密）。
     """
     ssl_ctx = _ssl_context()
     if ssl_ctx is None:
         import log
-        log.logger.warning("SSL cert not found, serving HTTP only on port %s "
-                           "(admin UI will not be encrypted).", port)
+        log.logger.warning("SSL cert not found, serving HTTP on both ports %s and %s "
+                           "(admin UI will not be encrypted).", port, ssl_port)
+        
+        # 无证书时，ssl_port 也启动 HTTP 服务
+        http_thread = threading.Thread(
+            target=run_simple,
+            args=("0.0.0.0", ssl_port, app),
+            kwargs={"threaded": True, "use_reloader": False},
+            daemon=True,
+            name="http-admin-server",
+        )
+        http_thread.start()
+        
+        # 主线程跑 webhook/health
         run_simple("0.0.0.0", port, app, threaded=True, use_reloader=False)
         return