diff --git a/docker/Dockerfile.agent b/docker/Dockerfile.agent
index ee92dfc2..b9cb8669 100644
--- a/docker/Dockerfile.agent
+++ b/docker/Dockerfile.agent
@@ -17,9 +17,8 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     go mod download
 
 COPY . .
-RUN apk add --no-cache curl \
-    && curl -fsSL -o internal/apps/agent/geoipdata/GeoLite2-Country.mmdb \
-      https://raw.githubusercontent.com/Loyalsoldier/geoip/release/GeoLite2-Country.mmdb
+RUN apk add --no-cache bash curl \
+    && bash scripts/fetch-agent-geoip-mmdb.sh
 RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
     go build -trimpath -ldflags "-s -w -X 'github.com/Rain-kl/Wavelet/internal/apps/agent/config.Version=$VERSION'" -o /build/bin/openflare-agent ./cmd/agent/main.go
diff --git a/docs/changelog/index.md b/docs/changelog/index.md
index 58f5e71e..bf78cf34 100644
--- a/docs/changelog/index.md
+++ b/docs/changelog/index.md
@@ -18,7 +18,7 @@ sidebar: false
 
 ### 修复
 
-- 修复 Agent CI/Docker 构建：`go:embed` 所需的 `GeoLite2-Country.mmdb` 在构建前通过 `scripts/fetch-agent-geoip-mmdb.sh` 自动拉取。
+- 修复 Agent CI/Docker 构建：将 `GeoLite2-Country.mmdb` 提交至仓库作为兜底，构建前优先尝试 `scripts/fetch-agent-geoip-mmdb.sh` 拉取最新库，远程失败时回退使用已提交文件。
 
 ## [v2.3.4] - 2026-06-17
 
diff --git a/internal/apps/agent/geoipdata/GeoLite2-Country.mmdb b/internal/apps/agent/geoipdata/GeoLite2-Country.mmdb
new file mode 100644
index 00000000..c6b1857b
Binary files /dev/null and b/internal/apps/agent/geoipdata/GeoLite2-Country.mmdb differ
diff --git a/scripts/fetch-agent-geoip-mmdb.sh b/scripts/fetch-agent-geoip-mmdb.sh
index 0097e320..5cadbd23 100755
--- a/scripts/fetch-agent-geoip-mmdb.sh
+++ b/scripts/fetch-agent-geoip-mmdb.sh
@@ -6,11 +6,20 @@ TARGET="${ROOT}/internal/apps/agent/geoipdata/GeoLite2-Country.mmdb"
 URL="${GEOIP_MMDB_URL:-https://raw.githubusercontent.com/Loyalsoldier/geoip/release/GeoLite2-Country.mmdb}"
 
 mkdir -p "$(dirname "$TARGET")"
-curl -fsSL -o "$TARGET" "$URL"
 
-if [ ! -s "$TARGET" ]; then
-  echo "downloaded GeoIP database is empty: $TARGET" >&2
+if curl -fsSL -o "${TARGET}.tmp" "$URL"; then
+  mv "${TARGET}.tmp" "$TARGET"
+  echo "GeoIP database downloaded: $TARGET"
+elif [ -s "$TARGET" ]; then
+  rm -f "${TARGET}.tmp"
+  echo "GeoIP download failed, using committed database: $TARGET"
+else
+  rm -f "${TARGET}.tmp"
+  echo "GeoIP database missing and download failed: $URL" >&2
   exit 1
 fi
 
-echo "GeoIP database ready: $TARGET"
\ No newline at end of file
+if [ ! -s "$TARGET" ]; then
+  echo "GeoIP database is empty: $TARGET" >&2
+  exit 1
+fi
\ No newline at end of file