diff --git a/sandbox-worker/install.sh b/sandbox-worker/install.sh
index ef4a420..a4a9e5a 100644
--- a/sandbox-worker/install.sh
+++ b/sandbox-worker/install.sh
@@ -23,12 +23,19 @@ KEEP_BACKUPS=3
 [[ "$(id -u)" == "0" ]] || { echo "❌ 请用 root / sudo 运行" >&2; exit 1; }
 [[ "$(uname -s)" == "Linux" ]] || { echo "❌ 仅支持 Linux" >&2; exit 1; }
 command -v curl >/dev/null || { echo "❌ 需要 curl" >&2; exit 1; }
-# node 可能装在普通用户的 nvm 下(root PATH 看不见)—— 先 PATH 找,再借 SUDO_USER 的登录环境找
-NODE_BIN="$(command -v node || true)"
+# node 可能装在普通用户的 nvm 下(root PATH 看不见)。查找顺序:
+#   1. 显式 NODE_BIN 环境变量(自升级路径:worker 传自己的 process.execPath)
+#   2. PATH;3. 已装 unit 的 ExecStart(升级场景,上次装机时已解析对);4. SUDO_USER 登录环境
+NODE_BIN="${NODE_BIN:-}"
+[[ -n "${NODE_BIN}" && -x "${NODE_BIN}" ]] || NODE_BIN="$(command -v node || true)"
+if [[ -z "${NODE_BIN}" && -f "/etc/systemd/system/${SERVICE}.service" ]]; then
+  NODE_BIN="$(awk -F= '/^ExecStart=/{print $2}' "/etc/systemd/system/${SERVICE}.service" | awk '{print $1}')"
+  [[ -x "${NODE_BIN}" ]] || NODE_BIN=""
+fi
 if [[ -z "${NODE_BIN}" && -n "${SUDO_USER:-}" ]]; then
   NODE_BIN="$(su - "${SUDO_USER}" -c 'command -v node' 2>/dev/null || true)"
 fi
-[[ -n "${NODE_BIN}" ]] || { echo "❌ 需要 Node.js ≥ 22(root 与 ${SUDO_USER:-当前用户} 的 PATH 均未找到 node)" >&2; exit 1; }
+[[ -n "${NODE_BIN}" ]] || { echo "❌ 需要 Node.js ≥ 22(NODE_BIN/PATH/unit/SUDO_USER 均未找到 node)" >&2; exit 1; }
 NODE_MAJOR=$("${NODE_BIN}" -e 'console.log(process.versions.node.split(".")[0])')
 [[ "${NODE_MAJOR}" -ge 22 ]] || { echo "❌ Node ≥ 22(当前 $("${NODE_BIN}" -v))" >&2; exit 1; }
 command -v docker >/dev/null || { echo "❌ 需要 Docker(worker 用它起沙箱容器)" >&2; exit 1; }