diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 1f3d91b4..5fb0a806 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -298,6 +298,9 @@ jobs:
         with:
           go-version-file: go.mod
 
+      - name: Fetch embedded GeoIP database
+        run: bash scripts/fetch-agent-geoip-mmdb.sh
+
       - name: Build Agent
         env:
           CGO_ENABLED: 0
diff --git a/.gitignore b/.gitignore
index 6a08acc4..8d511a21 100644
--- a/.gitignore
+++ b/.gitignore
@@ -77,4 +77,4 @@ profile.cov
 .grok
 /.gomodcache/
 *.mmdb
-!openflare_agent/internal/geoipdata/GeoLite2-Country.mmdb
\ No newline at end of file
+!internal/apps/agent/geoipdata/GeoLite2-Country.mmdb
\ No newline at end of file
diff --git a/Makefile b/Makefile
index 7a4f3c72..87eac661 100644
--- a/Makefile
+++ b/Makefile
@@ -40,6 +40,7 @@ build-backend:
 
 build-agent:
 	@echo "==> Building agent version=$(VERSION)..."
+	bash scripts/fetch-agent-geoip-mmdb.sh
 	go build \
 		-ldflags "-s -w -X '$(MODULE)/internal/apps/agent/config.Version=$(VERSION)'" \
 		-o bin/openflare-agent \
diff --git a/docker/Dockerfile.agent b/docker/Dockerfile.agent
index 77132672..ee92dfc2 100644
--- a/docker/Dockerfile.agent
+++ b/docker/Dockerfile.agent
@@ -17,6 +17,9 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     go mod download
 
 COPY . .
+RUN apk add --no-cache curl \
+    && curl -fsSL -o internal/apps/agent/geoipdata/GeoLite2-Country.mmdb \
+      https://raw.githubusercontent.com/Loyalsoldier/geoip/release/GeoLite2-Country.mmdb
 RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
     go build -trimpath -ldflags "-s -w -X 'github.com/Rain-kl/Wavelet/internal/apps/agent/config.Version=$VERSION'" -o /build/bin/openflare-agent ./cmd/agent/main.go
diff --git a/docs/changelog/index.md b/docs/changelog/index.md
index 27585746..58f5e71e 100644
--- a/docs/changelog/index.md
+++ b/docs/changelog/index.md
@@ -16,6 +16,9 @@ sidebar: false
 
 ## [Unreleased]
 
+### 修复
+
+- 修复 Agent CI/Docker 构建：`go:embed` 所需的 `GeoLite2-Country.mmdb` 在构建前通过 `scripts/fetch-agent-geoip-mmdb.sh` 自动拉取。
 
 ## [v2.3.4] - 2026-06-17
 
diff --git a/scripts/fetch-agent-geoip-mmdb.sh b/scripts/fetch-agent-geoip-mmdb.sh
new file mode 100755
index 00000000..0097e320
--- /dev/null
+++ b/scripts/fetch-agent-geoip-mmdb.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+TARGET="${ROOT}/internal/apps/agent/geoipdata/GeoLite2-Country.mmdb"
+URL="${GEOIP_MMDB_URL:-https://raw.githubusercontent.com/Loyalsoldier/geoip/release/GeoLite2-Country.mmdb}"
+
+mkdir -p "$(dirname "$TARGET")"
+curl -fsSL -o "$TARGET" "$URL"
+
+if [ ! -s "$TARGET" ]; then
+  echo "downloaded GeoIP database is empty: $TARGET" >&2
+  exit 1
+fi
+
+echo "GeoIP database ready: $TARGET"
\ No newline at end of file