diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index a2734e0..8ff6448 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -82,6 +82,6 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-to: type=gha,mode=max,ignore-error=true
           provenance: mode=max
           sbom: true
diff --git a/config/config.yaml b/config/config.yaml
index 2cb8543..5ee4390 100644
--- a/config/config.yaml
+++ b/config/config.yaml
@@ -148,13 +148,13 @@ rule-providers:
   BanAD: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/BanAD.yaml}
   BanProgramAD: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/BanProgramAD.yaml}
   GoogleFCM: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Ruleset/GoogleFCM.yaml}
-  GoogleCN: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/GoogleCN.yaml}
+  GoogleCN: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Ruleset/GoogleCN.yaml}
   SteamCN: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Ruleset/SteamCN.yaml}
-  Bing: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Bing.yaml}
-  OneDrive: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/OneDrive.yaml}
-  Microsoft: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Microsoft.yaml}
+  Bing: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Ruleset/Bing.yaml}
+  OneDrive: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Ruleset/OneDrive.yaml}
+  Microsoft: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Ruleset/Microsoft.yaml}
   Apple: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Apple.yaml}
-  Telegram: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Telegram.yaml}
+  Telegram: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Ruleset/Telegram.yaml}
   AI: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Ruleset/AI.yaml}
   OpenAi: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Ruleset/OpenAi.yaml}
   NetEaseMusic: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Ruleset/NetEaseMusic.yaml}
@@ -172,7 +172,7 @@ rule-providers:
   ProxyMedia: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/ProxyMedia.yaml}
   ProxyGFWlist: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/ProxyGFWlist.yaml}
   ChinaDomain: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/ChinaDomain.yaml}
-  ChinaCompanyIp: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/ChinaCompanyIp.yaml}
+  ChinaCompanyIp: {type: file, behavior: ipcidr, format: yaml, path: /usr/local/share/ssclash/rules/ChinaCompanyIp.yaml}
   Download: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Download.yaml}
 
 rules:
diff --git a/internal/bootstrap/bootstrap_test.go b/internal/bootstrap/bootstrap_test.go
index 0f1990b..e5aab69 100644
--- a/internal/bootstrap/bootstrap_test.go
+++ b/internal/bootstrap/bootstrap_test.go
@@ -282,16 +282,25 @@ func TestRunStopsServicesWhenRollbackReloadFails(t *testing.T) {
 	}))
 	defer server.Close()
 
-	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+	runResult := make(chan error, 1)
+	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
-	err := Run(ctx, RuntimeConfig{
-		CoreBinary:      binary,
-		SSClashBinary:   binary,
-		ConfigSource:    config,
-		RuntimeDir:      filepath.Join(tempDir, "runtime"),
-		SubscriptionURL: server.URL,
-		UpdateInterval:  20 * time.Millisecond,
-	})
+	go func() {
+		runResult <- Run(ctx, RuntimeConfig{
+			CoreBinary:      binary,
+			SSClashBinary:   binary,
+			ConfigSource:    config,
+			RuntimeDir:      filepath.Join(tempDir, "runtime"),
+			SubscriptionURL: server.URL,
+			UpdateInterval:  20 * time.Millisecond,
+		})
+	}()
+	var err error
+	select {
+	case err = <-runResult:
+	case <-time.After(5 * time.Second):
+		t.Fatal("Run() did not reach rollback failure")
+	}
 	if !errors.Is(err, errMihomoStateUncertain) {
 		t.Fatalf("Run() error = %v, want uncertain Mihomo state", err)
 	}
diff --git a/internal/bootstrap/config_contract_test.go b/internal/bootstrap/config_contract_test.go
index d5a42d5..2cce39b 100644
--- a/internal/bootstrap/config_contract_test.go
+++ b/internal/bootstrap/config_contract_test.go
@@ -52,6 +52,12 @@ func TestSeededConfigUsesLocalACL4SSRRulesAndMemorySubscription(t *testing.T) {
 		"RULE-SET,BanAD,🛑 广告拦截",
 		"RULE-SET,ProxyGFWlist,🚀 节点选择",
 		"MATCH,🐟 漏网之鱼",
+		"GoogleCN: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Ruleset/GoogleCN.yaml}",
+		"Bing: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Ruleset/Bing.yaml}",
+		"OneDrive: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Ruleset/OneDrive.yaml}",
+		"Microsoft: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Ruleset/Microsoft.yaml}",
+		"Telegram: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Ruleset/Telegram.yaml}",
+		"ChinaCompanyIp: {type: file, behavior: ipcidr, format: yaml, path: /usr/local/share/ssclash/rules/ChinaCompanyIp.yaml}",
 	} {
 		if !strings.Contains(config, required) {
 			t.Errorf("seeded config is missing %q", required)
diff --git a/tests/workflow-contract.sh b/tests/workflow-contract.sh
index 05f16f8..01594ca 100755
--- a/tests/workflow-contract.sh
+++ b/tests/workflow-contract.sh
@@ -13,6 +13,7 @@ grep -F 'packages: write' "$workflow" >/dev/null
 grep -F 'ghcr.io/${{ github.repository }}' "$workflow" >/dev/null
 grep -F 'platforms: linux/amd64' "$workflow" >/dev/null
 grep -F 'needs: test' "$workflow" >/dev/null
+grep -F 'cache-to: type=gha,mode=max,ignore-error=true' "$workflow" >/dev/null
 # Match the GitHub expression literally.
 # shellcheck disable=SC2016
 grep -F 'push: ${{ github.event_name != '\''pull_request'\'' }}' "$workflow" >/dev/null