diff --git a/README.md b/README.md
index 2b2be5a..e3cd44a 100644
--- a/README.md
+++ b/README.md
@@ -21,7 +21,7 @@
 3. Comment 加上些許 emoji 讓資訊有點活力
 4. 盡量將應用程式放在 ./app，修改 entrypoint.sh 與 Dockerfile 讓程式可以正常運行
 5. 將提示詞放到 ./app/prompts 內供程式讀取
-6. API Key 支援逗號分隔傳入多個，依序嘗試，失敗時自動換下一個，全部失敗則 exit 1
+6. API Key 支援逗號分隔傳入多個，隨機順序各嘗試一次，全部失敗則 exit 1
 
 # 使用說明
 
diff --git a/TODO.md b/TODO.md
index c605eac..225c458 100644
--- a/TODO.md
+++ b/TODO.md
@@ -36,7 +36,7 @@
 - 完成
 
 ## 階段八：API Key 輪替
-- 目標：所有平台的 API Key 支援逗號分隔傳入多個，依序嘗試，單一 Key 失敗時自動換下一個，全部失敗則 exit 1。
+- 目標：所有平台的 API Key 支援逗號分隔傳入多個，隨機順序各嘗試一次，單一 Key 失敗時自動換下一個，全部失敗則 exit 1。
 - 驗收：log 中能看到「key[N/M] 失敗」等訊息，換 key 後繼續執行；傳入單一 Key 時行為與原本相同；全部 Key 失敗時 log「所有 API Key 均失敗，終止流程」且 workflow 狀態為失敗。
 - 完成
 
diff --git a/app/llm.js b/app/llm.js
index e2c2db1..1b009e0 100644
--- a/app/llm.js
+++ b/app/llm.js
@@ -10,19 +10,20 @@ export async function chat(systemPrompt, userContent) {
   const headers = { 'Content-Type': 'application/json' };
   if (provider === 'claude') headers['anthropic-version'] = '2023-06-01';
 
+  const shuffled = [...apiKeys].sort(() => Math.random() - 0.5);
   let lastError;
-  for (let i = 0; i < apiKeys.length; i++) {
-    if (provider !== 'ollama') headers['Authorization'] = `Bearer ${apiKeys[i]}`;
+  for (let i = 0; i < shuffled.length; i++) {
+    if (provider !== 'ollama') headers['Authorization'] = `Bearer ${shuffled[i]}`;
     try {
       const resp = await axios.post(
         `${baseURL.replace(/\/$/, '')}/chat/completions`,
         { model, messages: [{ role: 'system', content: systemPrompt }, { role: 'user', content: userContent }], temperature: 0.2 },
-        { headers, timeout: 30000 }
+        { headers }
       );
       return resp.data.choices[0].message.content;
     } catch (e) {
       lastError = e;
-      console.log(`  [LLM] key[${i + 1}/${apiKeys.length}] 失敗: ${e.message}`);
+      console.log(`  [LLM] key[${i + 1}/${shuffled.length}] 失敗: ${e.message}`);
     }
   }
   console.error('  [LLM] 所有 API Key 均失敗，終止流程');
diff --git a/app/llm.test.js b/app/llm.test.js
index 74f41f6..c94b893 100644
--- a/app/llm.test.js
+++ b/app/llm.test.js
@@ -48,18 +48,18 @@ describe('chat - key rotation', async () => {
     assert.equal(result, 'hello');
   });
 
-  it('rotates to second key when first fails', async () => {
-    process.env.OPENAI_API_KEY = 'key1,key2';
-    mockAxiosPost([new Error('rate limit'), makeOkResponse('from key2')]);
-    const result = await chat('sys', 'user');
-    assert.equal(result, 'from key2');
-  });
-
-  it('rotates through all keys and succeeds on last', async () => {
-    process.env.OPENAI_API_KEY = 'k1,k2,k3';
-    mockAxiosPost([new Error('fail'), new Error('fail'), makeOkResponse('from k3')]);
-    const result = await chat('sys', 'user');
-    assert.equal(result, 'from k3');
+  it('shuffles keys and tries each exactly once', async () => {
+    process.env.OPENAI_API_KEY = 'key1,key2,key3';
+    const usedKeys = [];
+    mock.method(axios, 'post', async (_url, _body, opts) => {
+      usedKeys.push(opts.headers['Authorization'].replace('Bearer ', ''));
+      throw new Error('fail');
+    });
+    const exitMock = mock.method(process, 'exit', () => { throw new Error('exit:1'); });
+    await assert.rejects(() => chat('sys', 'user'), /exit:1/);
+    assert.equal(exitMock.mock.calls[0].arguments[0], 1);
+    assert.equal(usedKeys.length, 3);
+    assert.deepEqual([...usedKeys].sort(), ['key1', 'key2', 'key3']);
   });
 
   it('calls process.exit(1) when all keys fail', async () => {
@@ -93,7 +93,7 @@ describe('chat - key rotation', async () => {
     assert.equal(capturedHeaders['Authorization'], 'Bearer sk-test');
   });
 
-  it('uses 30s timeout', async () => {
+  it('does not set timeout', async () => {
     process.env.OPENAI_API_KEY = 'sk-test';
     let capturedOpts;
     mock.method(axios, 'post', async (_url, _body, opts) => {
@@ -101,7 +101,7 @@ describe('chat - key rotation', async () => {
       return makeOkResponse();
     });
     await chat('sys', 'user');
-    assert.equal(capturedOpts.timeout, 30000);
+    assert.equal(capturedOpts.timeout, undefined);
   });
 
   it('does not pass httpsAgent to axios', async () => {