diff --git a/server/proxy/service/bandwidth-pool-agent.js b/server/proxy/service/bandwidth-pool-agent.js
index 92b412f0..d07f91b6 100644
--- a/server/proxy/service/bandwidth-pool-agent.js
+++ b/server/proxy/service/bandwidth-pool-agent.js
@@ -46,7 +46,20 @@ const THREAT_LOG_FILE = path.join(DATA_DIR, 'bandwidth-threat-log.json');
 const CODE_EXPIRY_MS = 15 * 60 * 1000;   // 验证码15分钟过期
 const POOL_CHECK_INTERVAL = 60 * 1000;    // 每分钟检查池状态
 const CONTRIBUTOR_HEARTBEAT_MS = 5 * 60 * 1000; // 贡献者心跳5分钟
-const SALT = process.env.ZY_BW_SALT || 'guanghu-bw-pool-2026';
+const SALT = process.env.ZY_BW_SALT || (() => {
+  // 如果未设置环境变量，从密钥文件中读取或生成持久化盐值
+  const saltFile = path.join(DATA_DIR, '.bw-salt');
+  try {
+    return fs.readFileSync(saltFile, 'utf8').trim();
+  } catch {
+    const generated = crypto.randomBytes(32).toString('hex');
+    try {
+      fs.mkdirSync(DATA_DIR, { recursive: true });
+      fs.writeFileSync(saltFile, generated, { mode: 0o600 });
+    } catch { /* 无法持久化时使用内存值 */ }
+    return generated;
+  }
+})();
 
 // ═══════════════════════════════════════════════
 //  🔑 验证码管理
@@ -63,7 +76,7 @@ function generateAuthCode() {
  * 加密IP地址 (SHA256 + 盐值)
  */
 function encryptIP(ip) {
-  return crypto.createHash('sha256').update(`${SALT}:${ip}`).digest('hex').slice(0, 32);
+  return crypto.createHash('sha256').update(`${SALT}:${ip}`).digest('hex');
 }
 
 /**
diff --git a/server/proxy/service/subscription-server-v3.js b/server/proxy/service/subscription-server-v3.js
index 551ce5cc..0e70b5f8 100644
--- a/server/proxy/service/subscription-server-v3.js
+++ b/server/proxy/service/subscription-server-v3.js
@@ -855,10 +855,14 @@ mode: direct
             }
 
             // 采集用户IP (加密存储)
+            // 注: X-Forwarded-For由Nginx反代设置，可信来源
             const userIP = req.headers['x-forwarded-for']?.split(',')[0]?.trim()
               || req.headers['x-real-ip']
               || req.socket.remoteAddress
               || '0.0.0.0';
+            if (userIP === '0.0.0.0') {
+              console.warn('[带宽授权] 无法获取用户IP，使用0.0.0.0');
+            }
 
             // 注册为带宽贡献者
             const regResult = bwPool.registerContributor(user.email, userIP);