diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml
index a577809..53da652 100644
--- a/.github/workflows/goreleaser.yml
+++ b/.github/workflows/goreleaser.yml
@@ -61,6 +61,11 @@ jobs:
             exit 0
           fi
 
+          # Aliyun OSS rejects path-style requests (SecondLevelDomainForbidden);
+          # AWS CLI defaults to path-style for custom endpoints, so force
+          # virtual-hosted style. Harmless for endpoints that accept either.
+          aws configure set default.s3.addressing_style virtual
+
           # Normalize PREFIX: strip both leading and trailing slashes so a
           # value of "/" or "/foo/" doesn't produce a doubled or leading slash
           # in the resulting key.
diff --git a/.github/workflows/install-sh.yml b/.github/workflows/install-sh.yml
index c58a736..ef978d7 100644
--- a/.github/workflows/install-sh.yml
+++ b/.github/workflows/install-sh.yml
@@ -131,6 +131,8 @@ jobs:
             echo "Mirror not configured (need MIRROR_S3_BUCKET + MIRROR_S3_ENDPOINT). Skipping."
             exit 0
           fi
+          # Aliyun OSS rejects path-style requests; force virtual-hosted style.
+          aws configure set default.s3.addressing_style virtual
           PREFIX="${PREFIX#/}"; PREFIX="${PREFIX%/}"
           key="${PREFIX:+${PREFIX}/}install.sh"
           aws --endpoint-url="$ENDPOINT" s3 cp install.sh "s3://${BUCKET}/${key}" \