diff --git a/docs/design/environments-and-delivery.md b/docs/design/environments-and-delivery.md
index 84def6b..ae23f90 100644
--- a/docs/design/environments-and-delivery.md
+++ b/docs/design/environments-and-delivery.md
@@ -145,7 +145,7 @@ OBFS_PASSWORD = Secret Manager version 引用
 PROXY_USERS_JSON = Secret Manager version 引用
 ```
 
-以上全部字段由部署 job 拥有，platform 的 OpenTofu 定义必须对它们声明 `lifecycle { ignore_changes }`，详见[基础设施与身份](infrastructure-and-identity.md)；platform apply 不得覆盖这些字段。
+以上全部字段由部署 job 拥有，platform 的 OpenTofu 定义必须对它们声明 `lifecycle { ignore_changes }`，同时忽略 gcloud 写入的 `client` 与 `client_version` 部署者元数据，详见[基础设施与身份](infrastructure-and-identity.md)；platform apply 不得覆盖这些字段，也不得为清除部署者元数据制造空更新。
 
 Secret version 创建成功但 revision 失败时允许保留该 version 供审计和重试。
 
diff --git a/infra/modules/subscription_service/main.tf b/infra/modules/subscription_service/main.tf
index b637ac1..c7da7ce 100644
--- a/infra/modules/subscription_service/main.tf
+++ b/infra/modules/subscription_service/main.tf
@@ -60,6 +60,8 @@ resource "google_cloud_run_v2_service" "subscription" {
 
   lifecycle {
     ignore_changes = [
+      client,
+      client_version,
       template[0].containers[0].env,
       template[0].containers[0].image,
       traffic,
diff --git a/scripts/infra/test-guards.sh b/scripts/infra/test-guards.sh
index 75630c1..ead179b 100755
--- a/scripts/infra/test-guards.sh
+++ b/scripts/infra/test-guards.sh
@@ -23,6 +23,10 @@ rg -q '确认值不匹配' "$destroy_guard_log" || infra::die "destroy 拒绝原
 rg -q -- '-auto-approve' "${SCRIPT_DIR}/destroy-platform.sh" || infra::die "GitHub destroy 必须显式非交互批准"
 rg -q -- '-input=false' "${SCRIPT_DIR}/destroy-platform.sh" || infra::die "GitHub destroy 不得等待交互输入"
 
+subscription_module="${INFRA_ROOT}/infra/modules/subscription_service/main.tf"
+rg -q '^[[:space:]]+client,$' "$subscription_module" || infra::die "platform 必须忽略 Cloud Run deploy client 元数据"
+rg -q '^[[:space:]]+client_version,$' "$subscription_module" || infra::die "platform 必须忽略 Cloud Run deploy client version 元数据"
+
 development_file=$(infra::require_environment development)
 production_file=$(infra::require_environment production)
 development_project=$(infra::read_tfvar "$development_file" project_id)