diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fefe356..a92af10 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -70,11 +70,23 @@ jobs:
 
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v3
+        if: ${{ vars.ENABLE_GHCR_PUSH == 'true' }}
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Validate Docker Hub credentials
+        if: ${{ vars.ENABLE_DOCKERHUB_PUSH == 'true' }}
+        env:
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+        run: |
+          if [ -z "$DOCKERHUB_USERNAME" ] || [ -z "$DOCKERHUB_TOKEN" ]; then
+            echo "ENABLE_DOCKERHUB_PUSH=true requires DOCKERHUB_USERNAME and DOCKERHUB_TOKEN secrets."
+            exit 1
+          fi
+
       - name: Login to Docker Hub
         uses: docker/login-action@v3
         if: ${{ vars.ENABLE_DOCKERHUB_PUSH == 'true' }}
@@ -82,13 +94,12 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Build & push multi-arch images
+      - name: Build & push GHCR multi-arch images
+        if: ${{ vars.ENABLE_GHCR_PUSH == 'true' }}
+        run: make docker-push-ghcr-multiarch VERSION=${{ github.ref_name }}
+
+      - name: Build & push Docker Hub multi-arch images
+        if: ${{ vars.ENABLE_DOCKERHUB_PUSH == 'true' }}
         env:
-          ENABLE_DOCKERHUB_PUSH: ${{ vars.ENABLE_DOCKERHUB_PUSH }}
           DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
-        run: |
-          DH_FLAG=0
-          if [ "$ENABLE_DOCKERHUB_PUSH" = "true" ] && [ -n "$DOCKERHUB_USERNAME" ]; then
-            DH_FLAG=1
-          fi
-          make docker-push VERSION=${{ github.ref_name }} DOCKERHUB_PUSH=$DH_FLAG
+        run: make docker-push-dockerhub-multiarch VERSION=${{ github.ref_name }}
diff --git a/webapp-react/src/components/sites/AdvancedConfigModal.tsx b/webapp-react/src/components/sites/AdvancedConfigModal.tsx
index 866bece..b77db0f 100644
--- a/webapp-react/src/components/sites/AdvancedConfigModal.tsx
+++ b/webapp-react/src/components/sites/AdvancedConfigModal.tsx
@@ -1,4 +1,4 @@
-import { Alert, Button, Group, LoadingOverlay, Modal, NumberInput, Radio, ScrollArea, Select, Stack, Switch, Tabs, Text, Textarea } from '@mantine/core'
+import { Alert, Button, Group, LoadingOverlay, Modal, NumberInput, Radio, ScrollArea, Select, Stack, Switch, Tabs, Text, Textarea, TextInput } from '@mantine/core'
 import { useForm } from '@mantine/form'
 import { useMediaQuery } from '@mantine/hooks'
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
@@ -178,8 +178,16 @@ function DefaultSitePanel({ enabled }: { enabled: boolean }) {
 
 function HTTPSHijackPanel({ enabled }: { enabled: boolean }) {
   const queryClient = useQueryClient()
-  const hijackForm = useForm<Pick<HTTPSHijackSettings, 'enabled' | 'return_status_code' | 'cert_mode'> & { custom_cert_id: string }>({
-    initialValues: { enabled: false, return_status_code: 444, cert_mode: 'self_signed', custom_cert_id: '' },
+  const hijackForm = useForm<Pick<HTTPSHijackSettings, 'enabled' | 'cert_mode'> & { return_status_code: string; custom_cert_id: string }>({
+    initialValues: { enabled: false, return_status_code: '444', cert_mode: 'self_signed', custom_cert_id: '' },
+    validate: {
+      return_status_code: (value) => {
+        const statusCode = Number(value)
+        if (!/^\d+$/.test(value)) return '请输入数字状态码'
+        if (statusCode < 400 || statusCode > 599) return '状态码范围为 400-599'
+        return null
+      },
+    },
   })
   const hijackQuery = useQuery({ queryKey: ['settings', 'https-hijack'], queryFn: getHTTPSHijack, enabled })
   const certsQuery = useQuery({ queryKey: ['certificates'], queryFn: listCertificates, enabled })
@@ -189,7 +197,7 @@ function HTTPSHijackPanel({ enabled }: { enabled: boolean }) {
     if (!hijackQuery.data) return
     hijackForm.setValues({
       enabled: hijackQuery.data.enabled,
-      return_status_code: hijackQuery.data.return_status_code || 444,
+      return_status_code: String(hijackQuery.data.return_status_code || 444),
       cert_mode: hijackQuery.data.cert_mode || 'self_signed',
       custom_cert_id: hijackQuery.data.custom_cert_id || '',
     })
@@ -198,7 +206,7 @@ function HTTPSHijackPanel({ enabled }: { enabled: boolean }) {
   async function saveHijack(values: typeof hijackForm.values) {
     await saveHijackMutation.mutateAsync({
       enabled: values.enabled,
-      return_status_code: values.return_status_code,
+      return_status_code: Number(values.return_status_code),
       cert_mode: values.cert_mode,
       custom_cert_id: values.cert_mode === 'custom' ? values.custom_cert_id : undefined,
     })
@@ -224,7 +232,13 @@ function HTTPSHijackPanel({ enabled }: { enabled: boolean }) {
         <Switch label="启用 HTTPS 防窜站" {...hijackForm.getInputProps('enabled', { type: 'checkbox' })} />
         {hijackForm.values.enabled ? (
           <Stack gap="md">
-            <NumberInput label="返回状态码" min={400} max={599} allowDecimal={false} clampBehavior="strict" description="推荐 444（直接关闭连接）或 403（禁止访问）。" {...hijackForm.getInputProps('return_status_code')} />
+            <TextInput
+              label="返回状态码"
+              inputMode="numeric"
+              description="推荐 444（直接关闭连接）或 403（禁止访问）。"
+              {...hijackForm.getInputProps('return_status_code')}
+              onChange={(event) => hijackForm.setFieldValue('return_status_code', event.currentTarget.value.replace(/\D/g, ''))}
+            />
             <Radio.Group label="证书来源" {...hijackForm.getInputProps('cert_mode')}>
               <Group mt="xs"><Radio value="self_signed" label="自动生成自签证书" /><Radio value="custom" label="从证书夹选择" /></Group>
             </Radio.Group>