diff --git a/scripts/create_tables.py b/scripts/create_tables.py
index 374e2c2..0d7b0e8 100644
--- a/scripts/create_tables.py
+++ b/scripts/create_tables.py
@@ -143,6 +143,18 @@ CREATE TABLE IF NOT EXISTS sd_audit_logs (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
 """
 
+# git 级串行锁表：多 worker（含跨主机）对同一 repo 的 git 操作互斥，带 TTL 自动释放
+# (expires_at 过期可被下一个申请者原子接管)。lock_key = sha256(repo_abs_path)。
+_GIT_LOCKS_DDL = """
+CREATE TABLE IF NOT EXISTS pipeline_git_locks (
+  `lock_key` varchar(64) NOT NULL,
+  `token` varchar(64) NOT NULL,
+  `expires_at` datetime NOT NULL,
+  PRIMARY KEY (`lock_key`),
+  KEY `idx_expires` (`expires_at`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+"""
+
 
 def split_ddl(ddl):
     """按分号分割 DDL，跳过注释行和空语句。"""
@@ -283,6 +295,13 @@ async def main():
         except Exception as e:
             print(f'  WARN: sd_audit_logs ensure failed: {e}')
 
+        # git 级串行锁表（跨主机多 worker 对同 repo git 操作互斥）
+        try:
+            await sor.execute(_GIT_LOCKS_DDL, {})
+            print('  tables: pipeline_git_locks ensured (idempotent)')
+        except Exception as e:
+            print(f'  WARN: pipeline_git_locks ensure failed: {e}')
+
 
 if __name__ == '__main__':
     asyncio.run(main())