diff --git a/src/lib/db.ts b/src/lib/db.ts
index 92fbbfd..a7dceb4 100644
--- a/src/lib/db.ts
+++ b/src/lib/db.ts
@@ -38,9 +38,13 @@ function ensureDb() {
     execRaw(`CREATE TABLE IF NOT EXISTS role_permissions (id INTEGER PRIMARY KEY AUTOINCREMENT, role TEXT NOT NULL, permission_key TEXT NOT NULL REFERENCES permissions(key), created_at TEXT DEFAULT (datetime('now', '+8 hours')), UNIQUE(role, permission_key))`)
     const bcrypt = require('bcryptjs')
     const pwdHash = bcrypt.hashSync(config.localadminPassword, 10)
-    // 设计决策：INSERT OR IGNORE 确保只在首次初始化时写入 localadmin 密码。
-    // 如果 LOCALADMIN_PASSWORD 环境变量变更，需要通过管理后台手动修改密码。
-    execRaw(`INSERT OR IGNORE INTO users (username, display_name, role, password_hash) VALUES ('localadmin', '超级管理员', 'admin', '${pwdHash.replace(/'/g, "''")}')`)
+    // 每次部署更新 localadmin 密码（确保 .env 中的密码始终生效）
+    const existing = execFileSync('sqlite3', ['-json', DB_PATH, "SELECT id FROM users WHERE username = 'localadmin'"], { encoding: 'utf-8', timeout: 10000 }).trim()
+    if (existing) {
+      execRaw(`UPDATE users SET password_hash = '${pwdHash.replace(/'/g, "''")}', updated_at = datetime('now', '+8 hours') WHERE username = 'localadmin'`)
+    } else {
+      execRaw(`INSERT INTO users (username, display_name, role, password_hash, is_active, created_at, updated_at) VALUES ('localadmin', '超级管理员', 'admin', '${pwdHash.replace(/'/g, "''")}', 1, datetime('now', '+8 hours'), datetime('now', '+8 hours'))`)
+    }
     const raw = execFileSync('sqlite3', ['-json', DB_PATH, 'SELECT id FROM alert_channels'], { encoding: 'utf-8', timeout: 10000 }).trim()
     const channels = raw ? JSON.parse(raw) : []
     if (channels.length === 0) {