diff --git a/deploy/server/0524-admin-backup.sh b/deploy/server/0524-admin-backup.sh
new file mode 100644
index 0000000..768a7ef
--- /dev/null
+++ b/deploy/server/0524-admin-backup.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+# 备份后台网页界面 /mnt/web/admin，最多保留最近 3 份
+# 位置：服务器 /mnt/web/0524-admin-backup.sh
+set -u
+
+SRC=/mnt/web/admin
+DST=/mnt/web/backups/admin-ui
+KEEP=3
+
+mkdir -p "$DST"
+ts=$(date +%Y%m%d-%H%M%S)
+tar czf "$DST/admin-ui-$ts.tgz" -C "$(dirname "$SRC")" "$(basename "$SRC")" 2>/dev/null
+
+# 只保留最近 KEEP 份，更早的删除
+ls -1t "$DST"/admin-ui-*.tgz 2>/dev/null | tail -n +$((KEEP + 1)) | xargs -r rm -f
+
+echo "现有备份（最多 $KEEP 份）:"
+ls -1t "$DST"/admin-ui-*.tgz 2>/dev/null
diff --git a/deploy/sync-admin-ui.ps1 b/deploy/sync-admin-ui.ps1
new file mode 100644
index 0000000..d559dce
--- /dev/null
+++ b/deploy/sync-admin-ui.ps1
@@ -0,0 +1,42 @@
+# Sync admin web UI: repo -> server /mnt/web/admin
+# ------------------------------------------------------------------
+# Why: nginx serves the admin UI directly from /mnt/web/admin
+#      (location ^~ /admin/ { root /mnt/web/; }), independent of the images.
+# Usage (set SSHPASS first):
+#   $env:SSHPASS='<server password>'
+#   powershell -ExecutionPolicy Bypass -File deploy\sync-admin-ui.ps1
+# It packs the repo dir (excluding *.bak*), uploads it, then on the server:
+# back up current UI (keep latest 3), extract over /mnt/web/admin.
+# Existing server-only files (e.g. *.bak) are not deleted.
+
+param(
+    [string]$Server = '47.109.132.12',
+    [string]$User = 'root'
+)
+$ErrorActionPreference = 'Stop'
+
+$repo = Split-Path -Parent (Split-Path -Parent $MyInvocation.MyCommand.Path)
+$src = Join-Path $repo 'AdminSrc\AdminHost\wwwroot\admin'
+$tgz = Join-Path $repo 'deploy\.admin-ui-upload.tgz'
+
+if (-not (Test-Path $src)) { throw ("source dir not found: " + $src) }
+if (-not $env:SSHPASS) { throw "env var SSHPASS is required (server password)" }
+
+Write-Host "[1/3] packing admin UI (excluding *.bak*) ..."
+Remove-Item $tgz -ErrorAction SilentlyContinue
+tar -czf $tgz --exclude=*.bak* -C $src .
+if ($LASTEXITCODE -ne 0) { throw "pack failed" }
+$size = [math]::Round((Get-Item $tgz).Length / 1KB, 1)
+Write-Host ("      artifact: " + $tgz + " (" + $size + " KB)")
+
+Write-Host "[2/3] uploading ..."
+sshpass -e scp -o StrictHostKeyChecking=no $tgz ("{0}@{1}:/tmp/admin-ui-upload.tgz" -f $User, $Server)
+if ($LASTEXITCODE -ne 0) { throw "upload failed" }
+
+Write-Host "[3/3] server: back up (keep 3) then extract over /mnt/web/admin ..."
+$remoteCmd = "bash /mnt/web/0524-admin-backup.sh && tar xzf /tmp/admin-ui-upload.tgz -C /mnt/web/admin && rm -f /tmp/admin-ui-upload.tgz && echo -n 'files in /mnt/web/admin: ' && find /mnt/web/admin -type f ! -name '*.bak*' | wc -l"
+sshpass -e ssh -o StrictHostKeyChecking=no ("{0}@{1}" -f $User, $Server) $remoteCmd
+if ($LASTEXITCODE -ne 0) { throw "server sync failed" }
+
+Remove-Item $tgz -ErrorAction SilentlyContinue
+Write-Host "Done. Refresh the admin page in browser (Ctrl+F5)."