diff --git a/lib/config.sh b/lib/config.sh
index fd40a59..06434d6 100644
--- a/lib/config.sh
+++ b/lib/config.sh
@@ -243,7 +243,7 @@ COOLERCONTROL_PROJECT_URL="https://gitlab.com/coolercontrol/coolercontrol"
 COOLERCONTROL_DOCS_URL="https://docs.coolercontrol.org/getting-started.html"
 COOLERCONTROL_DEB_SETUP_URL="https://dl.cloudsmith.io/public/coolercontrol/coolercontrol/setup.deb.sh"
 IT87_REPO_URL="https://github.com/shauno8/it87.git"
-IT87_REPO_REF=""  # 留空使用默认分支最新提交；建议固定到已验证的版本标签
+IT87_REPO_REF="81ae4a610ea763fa7f8cd195e712c41f33207264"  # 已验证的 PGP 签名提交
 IT87_DKMS_NAME="it87"
 NVIDIA_ASSETS_BASE_URL="https://raw.githubusercontent.com/PVE-Tools/PVE-Tools-9/main/Modules/NVIDIA"
 NVIDIA_VGPU_UNLOCK_SO_URL="${NVIDIA_ASSETS_BASE_URL}/libvgpu_unlock_rs.so"
diff --git a/src/modules/10-third-party/it87-driver.sh b/src/modules/10-third-party/it87-driver.sh
index 6474de2..081f115 100644
--- a/src/modules/10-third-party/it87-driver.sh
+++ b/src/modules/10-third-party/it87-driver.sh
@@ -305,10 +305,20 @@ it87_install_dkms() {
     local src_dir="/usr/src/${IT87_DKMS_NAME:-it87}"
     log_step "克隆源码到 ${src_dir}..."
     if [[ -n "${IT87_REPO_REF}" ]]; then
-        if ! git clone --depth 1 --branch "${IT87_REPO_REF}" "${IT87_REPO_URL:-https://github.com/shauno8/it87.git}" "$src_dir"; then
+        # git init + fetch 比 git clone --branch 更可靠地支持任意 commit SHA
+        git init "$src_dir" >/dev/null 2>&1 || {
             display_error "源码克隆失败" "请检查网络连接和 git 可用性"
             return 1
-        fi
+        }
+        (
+            cd "$src_dir" || exit 1
+            git remote add origin "${IT87_REPO_URL:-https://github.com/shauno8/it87.git}" || exit 1
+            git fetch --depth 1 origin "${IT87_REPO_REF}" || exit 1
+            git checkout FETCH_HEAD || exit 1
+        ) || {
+            display_error "源码克隆失败" "请检查网络连接和 git 可用性"
+            return 1
+        }
     else
         if ! git clone --depth 1 "${IT87_REPO_URL:-https://github.com/shauno8/it87.git}" "$src_dir"; then
             display_error "源码克隆失败" "请检查网络连接和 git 可用性"
@@ -403,11 +413,22 @@ it87_install_direct() {
     # 克隆到临时目录
     log_step "克隆源码..."
     if [[ -n "${IT87_REPO_REF}" ]]; then
-        if ! git clone --depth 1 --branch "${IT87_REPO_REF}" "${IT87_REPO_URL:-https://github.com/shauno8/it87.git}" "$build_dir"; then
+        # git init + fetch 比 git clone --branch 更可靠地支持任意 commit SHA
+        git init "$build_dir" >/dev/null 2>&1 || {
             display_error "源码克隆失败" "请检查网络连接"
             rm -rf "$build_dir"
             return 1
-        fi
+        }
+        (
+            cd "$build_dir" || exit 1
+            git remote add origin "${IT87_REPO_URL:-https://github.com/shauno8/it87.git}" || exit 1
+            git fetch --depth 1 origin "${IT87_REPO_REF}" || exit 1
+            git checkout FETCH_HEAD || exit 1
+        ) || {
+            display_error "源码克隆失败" "请检查网络连接"
+            rm -rf "$build_dir"
+            return 1
+        }
     else
         if ! git clone --depth 1 "${IT87_REPO_URL:-https://github.com/shauno8/it87.git}" "$build_dir"; then
             display_error "源码克隆失败" "请检查网络连接"