diff --git a/.gitea/workflows/ci-pipeline.yml b/.gitea/workflows/ci-pipeline.yml
index 04902aef0..de0a655b5 100755
--- a/.gitea/workflows/ci-pipeline.yml
+++ b/.gitea/workflows/ci-pipeline.yml
@@ -1187,6 +1187,8 @@ jobs:
         COSYVOICE_API_KEY: ${{ secrets.COSYVOICE_API_KEY }}
         DASHSCOPE_API_KEY: ${{ secrets.DASHSCOPE_API_KEY }}
         MEDIAKIT_API_KEY: ${{ secrets.MEDIAKIT_API_KEY }}
+        WECHAT_APP_ID: ${{ secrets.WECHAT_APP_ID }}
+        WECHAT_APP_SECRET: ${{ secrets.WECHAT_APP_SECRET }}
       run: |
         set -eu
         echo "Rendering .env from template + secrets..."
diff --git a/deploy/configs/.env.production b/deploy/configs/.env.production
index 55ab74ff3..f14279411 100644
--- a/deploy/configs/.env.production
+++ b/deploy/configs/.env.production
@@ -214,3 +214,10 @@ MEDIAKIT_TIMEOUT=60
 # ==================== 监控（可选）====================
 # Sentry DSN（取消注释并填入实际值以启用错误追踪）
 # SENTRY_DSN=${SENTRY_DSN}
+
+
+# ==================== 微信开放平台 OAuth（网页扫码登录）====================
+# 回调域名：xiaoxiajianji.com（微信开放平台已配置）
+WECHAT_OPEN_APP_ID=${WECHAT_APP_ID}
+WECHAT_OPEN_APP_SECRET=${WECHAT_APP_SECRET}
+WECHAT_OPEN_REDIRECT_URI=https://saas.xiaoxiajianji.com/auth/wechat/callback
diff --git a/deploy/configs/.env.staging b/deploy/configs/.env.staging
index 538417191..9e09b91eb 100644
--- a/deploy/configs/.env.staging
+++ b/deploy/configs/.env.staging
@@ -231,3 +231,10 @@ DASHSCOPE_API_KEY=${DASHSCOPE_API_KEY}
 MEDIAKIT_API_KEY=${MEDIAKIT_API_KEY}
 MEDIAKIT_BASE_URL=https://mediakit.cn-beijing.volces.com/api/v1
 MEDIAKIT_TIMEOUT=60
+
+
+# ==================== 微信开放平台 OAuth（网页扫码登录）====================
+# 回调域名：xiaoxiajianji.com（微信开放平台已配置）
+WECHAT_OPEN_APP_ID=${WECHAT_APP_ID}
+WECHAT_OPEN_APP_SECRET=${WECHAT_APP_SECRET}
+WECHAT_OPEN_REDIRECT_URI=https://staging.xiaoxiajianji.com/auth/wechat/callback
diff --git a/scripts/render_env.sh b/scripts/render_env.sh
index 42930f6e1..a5f128045 100644
--- a/scripts/render_env.sh
+++ b/scripts/render_env.sh
@@ -57,7 +57,7 @@ if [ "$TARGET_ENV" = "staging" ]; then
 fi
 
 # 共用 secrets 直接导出（如果存在）
-SHARED_SECRETS="OSS_ACCESS_KEY_ID OSS_ACCESS_KEY_SECRET COSYVOICE_API_KEY DASHSCOPE_API_KEY MEDIAKIT_API_KEY"
+SHARED_SECRETS="OSS_ACCESS_KEY_ID OSS_ACCESS_KEY_SECRET COSYVOICE_API_KEY DASHSCOPE_API_KEY MEDIAKIT_API_KEY WECHAT_APP_ID WECHAT_APP_SECRET"
 for var in $SHARED_SECRETS; do
   value="${!var:-}"
   # 已经在环境中了，无需额外操作