diff --git a/Jenkinsfile.service b/Jenkinsfile.service
index 72b8e5f43..bd81515d2 100644
--- a/Jenkinsfile.service
+++ b/Jenkinsfile.service
@@ -194,38 +194,43 @@ pipeline {
             steps {
                 script {
                     String deploySlotLabel = "firstleg-${params.ENVIRONMENT}-deploy-slot"
+                    String serviceDeployResource = "firstleg-${params.ENVIRONMENT}-${env.RESOLVED_SERVICE}-deploy"
                     String credentialId = "firstleg-${params.ENVIRONMENT}-env"
                     String targetLabel = params.ENVIRONMENT == 'development' ? 'java-dev' : 'java-test'
-                    lock(label: deploySlotLabel, quantity: 1, inversePrecedence: true) {
-                        node(targetLabel) {
-                            deleteDir()
-                            try {
-                                unstash 'deployment-files'
-                                echo "在目标节点 ${env.NODE_NAME} 本机部署到 ${params.ENVIRONMENT}"
-                                List bridgeRegions = (env.RESOLVED_SERVICE == 'event-bridge-service' &&
-                                    (env.DEPLOY_BOTH_EVENT_BRIDGES == 'true' ||
-                                        ['BOTH', 'SELECT'].contains(params.EVENT_BRIDGE_REGION)))
-                                    ? ['CN', 'OVERSEAS']
-                                    : [params.EVENT_BRIDGE_REGION]
-                                withCredentials([
-                                    file(credentialsId: credentialId, variable: 'DEPLOY_ENV_FILE'),
-                                    usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS,
-                                        usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')
-                                ]) {
-                                    bridgeRegions.each { bridgeRegion ->
-                                        if (env.RESOLVED_SERVICE == 'event-bridge-service') {
-                                            echo "部署事件桥实例: ${bridgeRegion}"
-                                        }
-                                        withEnv([
-                                            'TARGET_IS_LOCAL=true',
-                                            "EVENT_BRIDGE_REGION_OVERRIDE=${bridgeRegion}"
-                                        ]) {
-                                            sh "sh deploy/scripts/deploy-built-service.sh '${params.ENVIRONMENT}' '${env.RESOLVED_IMAGE_REPOSITORY}' '${env.RESOLVED_IMAGE_TAG}' '${env.RESOLVED_SERVICE}' \"\$DEPLOY_ENV_FILE\""
+                    // 不同服务可以并行，但同一环境的同一服务只能有一个任务更新容器。
+                    // resource 未预配置时 Lockable Resources 会创建仅在构建期间存在的临时资源。
+                    lock(resource: serviceDeployResource, inversePrecedence: true) {
+                        lock(label: deploySlotLabel, quantity: 1, inversePrecedence: true) {
+                            node(targetLabel) {
+                                deleteDir()
+                                try {
+                                    unstash 'deployment-files'
+                                    echo "在目标节点 ${env.NODE_NAME} 本机部署到 ${params.ENVIRONMENT}"
+                                    List bridgeRegions = (env.RESOLVED_SERVICE == 'event-bridge-service' &&
+                                        (env.DEPLOY_BOTH_EVENT_BRIDGES == 'true' ||
+                                            ['BOTH', 'SELECT'].contains(params.EVENT_BRIDGE_REGION)))
+                                        ? ['CN', 'OVERSEAS']
+                                        : [params.EVENT_BRIDGE_REGION]
+                                    withCredentials([
+                                        file(credentialsId: credentialId, variable: 'DEPLOY_ENV_FILE'),
+                                        usernamePassword(credentialsId: env.REGISTRY_CREDENTIALS,
+                                            usernameVariable: 'REGISTRY_USER', passwordVariable: 'REGISTRY_PASSWORD')
+                                    ]) {
+                                        bridgeRegions.each { bridgeRegion ->
+                                            if (env.RESOLVED_SERVICE == 'event-bridge-service') {
+                                                echo "部署事件桥实例: ${bridgeRegion}"
+                                            }
+                                            withEnv([
+                                                'TARGET_IS_LOCAL=true',
+                                                "EVENT_BRIDGE_REGION_OVERRIDE=${bridgeRegion}"
+                                            ]) {
+                                                sh "sh deploy/scripts/deploy-built-service.sh '${params.ENVIRONMENT}' '${env.RESOLVED_IMAGE_REPOSITORY}' '${env.RESOLVED_IMAGE_TAG}' '${env.RESOLVED_SERVICE}' \"\$DEPLOY_ENV_FILE\""
+                                            }
                                         }
                                     }
+                                } finally {
+                                    cleanWs(deleteDirs: true, notFailBuild: true)
                                 }
-                            } finally {
-                                cleanWs(deleteDirs: true, notFailBuild: true)
                             }
                         }
                     }
diff --git a/scripts/test-environment-pipeline-contract.test.mjs b/scripts/test-environment-pipeline-contract.test.mjs
index cb9d380ce..22eaf133c 100644
--- a/scripts/test-environment-pipeline-contract.test.mjs
+++ b/scripts/test-environment-pipeline-contract.test.mjs
@@ -71,13 +71,17 @@ test('development and test deployment locks are acquired before target executors
     pipeline.indexOf("stage('部署开发或测试环境')"),
     pipeline.indexOf("stage('部署单个服务')")
   )
+  const serviceLockIndex = directDeployStage.indexOf('lock(resource: serviceDeployResource')
   const lockIndex = directDeployStage.indexOf('lock(label: deploySlotLabel')
   const nodeIndex = directDeployStage.indexOf('node(targetLabel)')
 
   assert.match(directDeployStage, /agent none/)
   assert.match(directDeployStage, /String targetLabel = params\.ENVIRONMENT == 'development' \? 'java-dev' : 'java-test'/)
+  assert.match(directDeployStage, /String serviceDeployResource = "firstleg-\$\{params\.ENVIRONMENT\}-\$\{env\.RESOLVED_SERVICE\}-deploy"/)
+  assert.ok(serviceLockIndex >= 0, 'per-service deployment lock must exist')
   assert.ok(lockIndex >= 0, 'deployment slot lock must exist')
   assert.ok(nodeIndex >= 0, 'target node allocation must exist')
+  assert.ok(serviceLockIndex < lockIndex, 'per-service lock must be acquired before the shared deployment slot')
   assert.ok(lockIndex < nodeIndex, 'deployment lock must be acquired before target node allocation')
 })