diff --git a/backend/app/core/database.py b/backend/app/core/database.py
index ae3ccd6..80343ca 100755
--- a/backend/app/core/database.py
+++ b/backend/app/core/database.py
@@ -66,17 +66,21 @@ async def init_db():
             PendingReplyTask, TokenStat, AIModelConfig, SystemConfig, LoginLog
         )
         async with engine.begin() as conn:
-            result = await conn.execute(text(
-                "SELECT COUNT(*) FROM information_schema.COLUMNS "
-                "WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'ai_model_configs' "
-                "AND COLUMN_NAME = 'usage_scope'"
-            ))
-            if result.scalar_one() == 0:
-                await conn.execute(text(
-                    "ALTER TABLE ai_model_configs ADD COLUMN usage_scope "
-                    "VARCHAR(16) NOT NULL DEFAULT 'general' AFTER provider"
+            await conn.execute(text("SELECT GET_LOCK('ai_model_usage_scope_migration', 30)"))
+            try:
+                result = await conn.execute(text(
+                    "SELECT COUNT(*) FROM information_schema.COLUMNS "
+                    "WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'ai_model_configs' "
+                    "AND COLUMN_NAME = 'usage_scope'"
                 ))
-                logger.info("AI模型配置表已增加 usage_scope 字段")
+                if result.scalar_one() == 0:
+                    await conn.execute(text(
+                        "ALTER TABLE ai_model_configs ADD COLUMN usage_scope "
+                        "VARCHAR(16) NOT NULL DEFAULT 'general' AFTER provider"
+                    ))
+                    logger.info("AI模型配置表已增加 usage_scope 字段")
+            finally:
+                await conn.execute(text("SELECT RELEASE_LOCK('ai_model_usage_scope_migration')"))
         logger.info("✅ 数据库模型注册成功")
         logger.info("✅ 数据库初始化完成")
 
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index f3cd1dd..9b8af48 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -6,7 +6,8 @@ RUN npm install
 COPY . .
 RUN npm run build
 
-FROM nginx:alpine
+# Nginx 1.31 uses syscalls that are blocked by the test server's legacy kernel.
+FROM nginx:1.28.3-alpine
 COPY --from=build /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 EXPOSE 80