diff --git a/jenkins/Jenkinsfile.preview-deployer b/jenkins/Jenkinsfile.preview-deployer
index 3f4e5961e..3d187edc4 100644
--- a/jenkins/Jenkinsfile.preview-deployer
+++ b/jenkins/Jenkinsfile.preview-deployer
@@ -93,13 +93,13 @@ pipeline {
           withCredentials([sshUserPrivateKey(credentialsId: env.GIT_REMOTE_CREDENTIAL_ID, keyFileVariable: 'GENARRATIVE_GIT_SSH_KEY')]) {
             sh '''
               set -euo pipefail
-              SOURCE_BRANCH="${SOURCE_BRANCH}" \
-              COMMIT_HASH="${COMMIT_HASH}" \
-              GIT_REMOTE_URL="${GIT_REMOTE_URL}" \
+              SOURCE_BRANCH="${SOURCE_BRANCH:-}" \
+              COMMIT_HASH="${COMMIT_HASH:-}" \
+              GIT_REMOTE_URL="${GIT_REMOTE_URL:-}" \
               SOURCE_COMMIT_FILE=".jenkins-source-commit" \
               GENARRATIVE_JENKINS_REUSE_EXISTING_CHECKOUT="true" \
               GIT_SSH_COMMAND="ssh -i ${GENARRATIVE_GIT_SSH_KEY} -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new" \
-              "${WORKSPACE}/scripts/jenkins-checkout-source.sh"
+              bash "${WORKSPACE}/scripts/jenkins-checkout-source.sh"
             '''
           }
         }
diff --git a/scripts/check-preview-deployer.mjs b/scripts/check-preview-deployer.mjs
index 32d1b0497..472f472fa 100644
--- a/scripts/check-preview-deployer.mjs
+++ b/scripts/check-preview-deployer.mjs
@@ -70,6 +70,21 @@ assertIncludes(
   'disableConcurrentBuilds()',
   'Jenkins Job 必须禁止并发构建。',
 );
+assertIncludes(
+  jenkinsfile,
+  'COMMIT_HASH="${COMMIT_HASH:-}"',
+  'Jenkins Checkout 阶段必须允许 COMMIT_HASH 未导出或为空。',
+);
+assertIncludes(
+  jenkinsfile,
+  'bash "${WORKSPACE}/scripts/jenkins-checkout-source.sh"',
+  'Jenkins Checkout 阶段必须显式使用 bash 执行源码检出脚本。',
+);
+assertExcludes(
+  jenkinsfile,
+  'COMMIT_HASH="${COMMIT_HASH}"',
+  'Jenkins Checkout 阶段不得在 set -u 下直接展开未导出的 COMMIT_HASH。',
+);
 assertIncludes(deployer, 'flock -x 9', '部署脚本必须使用跨进程独占锁。');
 assertIncludes(
   deployer,