diff --git a/.github/scripts/ci-validate-upgrade.sh b/.github/scripts/ci-validate-upgrade.sh
new file mode 100755
index 000000000..e92d89157
--- /dev/null
+++ b/.github/scripts/ci-validate-upgrade.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Run inside CI Docker container (or repo root). Validates upgrade loader + modules and key files.
+set -e
+
+echo "=== Shell syntax check ==="
+for f in cyberpanel_upgrade.sh preUpgrade.sh fix-phpmyadmin.sh cyberpanel.sh cyberpanel_utility.sh; do
+  [ ! -f "$f" ] && continue
+  bash -n "$f" || { echo "FAIL (syntax): $f"; exit 1; }
+  echo "OK $f"
+done
+test -f preUpgrade.sh && test -f cyberpanel_upgrade.sh || { echo "Missing required scripts"; exit 1; }
+
+echo "=== Key files ==="
+for f in preUpgrade.sh cyberpanel_upgrade.sh plogical/upgrade.py install/install.py; do
+  test -f "$f" || { echo "Missing: $f"; exit 1; }
+done
+grep -q 'BRANCH_NAME' preUpgrade.sh || exit 1
+
+if [ -d upgrade_modules ]; then
+  for n in 00_common 01_variables 02_checks 03_mariadb 04_git_url 05_repository 06_components 07_branch_input 08_main_upgrade 09_sync 10_post_tweak 11_display_final; do
+    test -f "upgrade_modules/${n}.sh" || { echo "Missing: upgrade_modules/${n}.sh"; exit 1; }
+  done
+  grep -q 'Branch_Check\|Branch_Name' upgrade_modules/00_common.sh upgrade_modules/02_checks.sh || exit 1
+  grep -q 'upgrade_modules\|Pre_Upgrade_Branch_Input\|Set_Default_Variables' cyberpanel_upgrade.sh || exit 1
+  for f in upgrade_modules/*.sh; do
+    [ -f "$f" ] || continue
+    bash -n "$f" || { echo "FAIL (syntax): $f"; exit 1; }
+  done
+else
+  grep -q 'Branch_Name\|download_install_phpmyadmin\|Branch_Check' cyberpanel_upgrade.sh || exit 1
+fi
+
+echo "Done."
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 68e4cb63b..006374ffc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -122,33 +122,8 @@ jobs:
       - uses: actions/checkout@v4
       - name: Validate on ${{ matrix.os }} (${{ matrix.image }})
         run: |
-          docker run --rm \
-            -v "$PWD:/repo:ro" \
-            -w /repo \
-            "${{ matrix.image }}" \
-            bash -c '
-              set -e
-              echo "=== Shell syntax check ==="
-              for f in cyberpanel_upgrade.sh preUpgrade.sh fix-phpmyadmin.sh cyberpanel.sh cyberpanel_utility.sh; do
-                [ ! -f "$f" ] && continue
-                bash -n "$f" || { echo "FAIL (syntax): $f"; exit 1; }
-                echo "OK $f"
-              done
-              test -f preUpgrade.sh && test -f cyberpanel_upgrade.sh || { echo "Missing required scripts"; exit 1; }
-              echo "=== Key files ==="
-              for f in preUpgrade.sh cyberpanel_upgrade.sh plogical/upgrade.py install/install.py; do
-                test -f "$f" || { echo "Missing: $f"; exit 1; }
-              done
-              grep -q "BRANCH_NAME" preUpgrade.sh || exit 1
-              if [ -d upgrade_modules ]; then
-                for n in 00_common 01_variables 02_checks 03_mariadb 04_git_url 05_repository 06_components 07_branch_input 08_main_upgrade 09_sync 10_post_tweak 11_display_final; do
-                  test -f "upgrade_modules/${n}.sh" || { echo "Missing: upgrade_modules/${n}.sh"; exit 1; }
-                done
-                grep -q "Branch_Check\|Branch_Name" upgrade_modules/00_common.sh upgrade_modules/02_checks.sh || exit 1
-                grep -q "upgrade_modules\|Pre_Upgrade_Branch_Input\|Set_Default_Variables" cyberpanel_upgrade.sh || exit 1
-                for f in upgrade_modules/*.sh; do [ -f "$f" ] && bash -n "$f" || exit 1; done
-              else
-                grep -q "Branch_Name\|download_install_phpmyadmin\|Branch_Check" cyberpanel_upgrade.sh || exit 1
-              fi
-              echo "Done."
-            '
+          if [ ! -f .github/scripts/ci-validate-upgrade.sh ]; then
+            echo "Missing .github/scripts/ci-validate-upgrade.sh"
+            exit 1
+          fi
+          docker run --rm -v "$PWD:/repo:ro" -w /repo "${{ matrix.image }}" bash /repo/.github/scripts/ci-validate-upgrade.sh