diff --git a/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/config/PasswordPartyConfig.java b/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/config/PasswordPartyConfig.java
index 25b8d932..fb77cf82 100644
--- a/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/config/PasswordPartyConfig.java
+++ b/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/config/PasswordPartyConfig.java
@@ -9,6 +9,11 @@ public class PasswordPartyConfig {
 
     private String baseUrl;
 
+    /**
+     * 密码服务平台鉴权令牌，置于请求头 Authorization 中
+     */
+    private String authToken;
+
     public String getBaseUrl() {
         return baseUrl;
     }
@@ -16,4 +21,12 @@ public class PasswordPartyConfig {
     public void setBaseUrl(String baseUrl) {
         this.baseUrl = baseUrl;
     }
+
+    public String getAuthToken() {
+        return authToken;
+    }
+
+    public void setAuthToken(String authToken) {
+        this.authToken = authToken;
+    }
 }
diff --git a/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/service/impl/PasswordPartyServiceImpl.java b/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/service/impl/PasswordPartyServiceImpl.java
index 3f0402df..3d2f4547 100644
--- a/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/service/impl/PasswordPartyServiceImpl.java
+++ b/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/service/impl/PasswordPartyServiceImpl.java
@@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.dromara.common.core.exception.base.BaseException;
+import org.dromara.common.core.utils.StringUtils;
 import org.dromara.system.config.PasswordPartyConfig;
 import org.dromara.system.domain.vo.SymmetryEncryptVo;
 import org.dromara.system.service.IPasswordPartyService;
@@ -231,11 +232,15 @@ public class PasswordPartyServiceImpl implements IPasswordPartyService {
             String url = passwordPartyConfig.getBaseUrl() + apiPath;
             log.info("HSM{}请求URL: {}, 参数: {}", apiName, url, params);
 
-            HttpResponse response = HttpRequest.post(url)
+            HttpRequest request = HttpRequest.post(url)
                 .header("Content-Type", "application/json;charset=utf-8")
                 .body(params.toJSONString())
-                .timeout(10000)
-                .execute();
+                .timeout(10000);
+            // 令牌配置存在时才携带鉴权头（dev 本地服务可能无鉴权）
+            if (StringUtils.isNotBlank(passwordPartyConfig.getAuthToken())) {
+                request.header("Authorization", passwordPartyConfig.getAuthToken());
+            }
+            HttpResponse response = request.execute();
 
             if (!response.isOk()) {
                 response.close();
diff --git a/zdxt-web-server/zdxt-admin-web-server/src/main/resources/application-dev.yml b/zdxt-web-server/zdxt-admin-web-server/src/main/resources/application-dev.yml
index 5ff5ab43..03d69c8c 100644
--- a/zdxt-web-server/zdxt-admin-web-server/src/main/resources/application-dev.yml
+++ b/zdxt-web-server/zdxt-admin-web-server/src/main/resources/application-dev.yml
@@ -350,6 +350,8 @@ srnwg:
 --- # 密码服务平台（HSM）
 password-party:
   base-url: http://localhost:8080
+  # 鉴权令牌（Authorization 请求头），无鉴权时留空
+  auth-token: ENC(待用Jasypt加密后的授权信息)
 --- # XSS过滤配置
 xss:
   # 开启XSS过滤
diff --git a/zdxt-web-server/zdxt-admin-web-server/src/main/resources/application-prod.yml b/zdxt-web-server/zdxt-admin-web-server/src/main/resources/application-prod.yml
index c4d44965..9267a00a 100644
--- a/zdxt-web-server/zdxt-admin-web-server/src/main/resources/application-prod.yml
+++ b/zdxt-web-server/zdxt-admin-web-server/src/main/resources/application-prod.yml
@@ -341,9 +341,8 @@ sjView: http://10.132.108.3/sjWeb
 
 --- # 密码服务平台（HSM）
 password-party:
-  HSM_HOST: http://10.134.84.40:10085/hsm
-  SVS_HOST: http://10.134.84.40:10085/svs
-  TSA_HOST: http://10.134.84.40:10085/tsa
+  base-url: http://10.134.84.40:10085
+  auth-token: ODE4MjY3OTcyNzQ4NTc4ODE2oZp51qbVDTfiIGpqckJwEXzx7gtZnViUlowNLl0EKj0=
 
 --- # 业务数据双向同步配置
 business-data-sync: