diff --git a/sundynix-admin/src/api.ts b/sundynix-admin/src/api.ts
index 758c149..0b5bdc7 100644
--- a/sundynix-admin/src/api.ts
+++ b/sundynix-admin/src/api.ts
@@ -231,6 +231,8 @@ export interface WechatPayConfig {
   mchid: string;
   cert_serial: string;
   private_key_path: string;
+  public_key_path: string; // 微信支付公钥（2024 起新商户体系；本商户 2025-09 开户）
+  public_key_id: string; // PUB_KEY_ID_ 开头
   appid: string;
   notify_url: string;
   has_apiv3_key: boolean;
@@ -248,6 +250,8 @@ export async function saveWechatPay(body: {
   mchid: string;
   cert_serial: string;
   private_key_path: string;
+  public_key_path: string;
+  public_key_id: string;
   apiv3_key: string;
   appid: string;
   notify_url: string;
diff --git a/sundynix-admin/src/components/TopupChannels.tsx b/sundynix-admin/src/components/TopupChannels.tsx
index 4268cad..4d7eec1 100644
--- a/sundynix-admin/src/components/TopupChannels.tsx
+++ b/sundynix-admin/src/components/TopupChannels.tsx
@@ -29,7 +29,7 @@ export function TopupChannels() {
 // APIv3 密钥只写不回显（密文入库，与模型 API Key 同一把密钥加密）；
 // 商户证书私钥文件放服务器磁盘，这里只填路径。
 function WechatConfigBlock() {
-  const empty: WechatPayConfig = { mchid: "", cert_serial: "", private_key_path: "", appid: "", notify_url: "", has_apiv3_key: false };
+  const empty: WechatPayConfig = { mchid: "", cert_serial: "", private_key_path: "", public_key_path: "", public_key_id: "", appid: "", notify_url: "", has_apiv3_key: false };
   const [cfg, setCfg] = useState<WechatPayConfig>(empty);
   const [apiv3, setApiv3] = useState(""); // 留空=沿用已存
   const [enabled, setEnabled] = useState(false);
@@ -56,6 +56,8 @@ function WechatConfigBlock() {
         mchid: cfg.mchid,
         cert_serial: cfg.cert_serial,
         private_key_path: cfg.private_key_path,
+        public_key_path: cfg.public_key_path,
+        public_key_id: cfg.public_key_id,
         apiv3_key: apiv3, // 空串=后端沿用旧密钥
         appid: cfg.appid,
         notify_url: cfg.notify_url,
@@ -102,6 +104,8 @@ function WechatConfigBlock() {
         {field("API 证书序列号", "cert_serial", "5157F09E…")}
         {field("appid（公众号/小程序）", "appid", "wx88888888")}
         {field("商户私钥文件路径（服务器磁盘）", "private_key_path", "/etc/sundynix/wechat/apiclient_key.pem", "md:col-span-2")}
+        {field("公钥 ID（PUB_KEY_ID_ 开头）", "public_key_id", "PUB_KEY_ID_01…")}
+        {field("微信支付公钥文件路径（服务器磁盘）", "public_key_path", "/etc/sundynix/wechat/pub_key.pem", "md:col-span-2")}
         <label className="text-xs text-gray-500">
           APIv3 密钥{cfg.has_apiv3_key && <span className="ml-1 text-emerald-600">已保存</span>}
           <input
diff --git a/sundynix-gateway/internal/handler/payment_admin.go b/sundynix-gateway/internal/handler/payment_admin.go
index 0a25f36..37dca0e 100644
--- a/sundynix-gateway/internal/handler/payment_admin.go
+++ b/sundynix-gateway/internal/handler/payment_admin.go
@@ -50,6 +50,8 @@ func (h *Handler) AdminGetWechatPay(c *gin.Context) {
 			"mchid":            cfg.MchID,
 			"cert_serial":      cfg.CertSerial,
 			"private_key_path": cfg.PrivateKeyPath,
+			"public_key_path":  cfg.PublicKeyPath,
+			"public_key_id":    cfg.PublicKeyID,
 			"appid":            cfg.AppID,
 			"notify_url":       cfg.NotifyURL,
 			"has_apiv3_key":    cfg.APIv3Key != "", // 密钥只报有无，明文永不回显
@@ -69,6 +71,8 @@ func (h *Handler) AdminSaveWechatPay(c *gin.Context) {
 		APIv3Key       string `json:"apiv3_key"`
 		AppID          string `json:"appid"`
 		NotifyURL      string `json:"notify_url"`
+		PublicKeyPath  string `json:"public_key_path"`
+		PublicKeyID    string `json:"public_key_id"`
 	}
 	if err := c.ShouldBindJSON(&b); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "参数错误"})
@@ -86,6 +90,8 @@ func (h *Handler) AdminSaveWechatPay(c *gin.Context) {
 		APIv3Key:       apiv3,
 		AppID:          strings.TrimSpace(b.AppID),
 		NotifyURL:      strings.TrimSpace(b.NotifyURL),
+		PublicKeyPath:  strings.TrimSpace(b.PublicKeyPath),
+		PublicKeyID:    strings.TrimSpace(b.PublicKeyID),
 	}
 	stored := cfg
 	if stored.APIv3Key != "" {
diff --git a/sundynix-gateway/internal/payment/manager.go b/sundynix-gateway/internal/payment/manager.go
index 859a2cb..83edf2b 100644
--- a/sundynix-gateway/internal/payment/manager.go
+++ b/sundynix-gateway/internal/payment/manager.go
@@ -20,20 +20,27 @@ type Config struct {
 	APIv3Key       string `json:"apiv3_key"`
 	AppID          string `json:"appid"`
 	NotifyURL      string `json:"notify_url"`
+	// 微信支付公钥验签体系（2024 起新注册商户只有这个；本项目商户 2025-09 开户，钉死此模式，
+	// 老商户的平台证书模式不做）。
+	PublicKeyPath string `json:"public_key_path"` // 微信支付公钥文件路径（服务器磁盘）
+	PublicKeyID   string `json:"public_key_id"`   // 公钥 ID（PUB_KEY_ID_ 开头）
 }
 
 // Empty 完全未配置（一个字段都没填）。
 func (c Config) Empty() bool {
 	return c.MchID == "" && c.CertSerial == "" && c.PrivateKeyPath == "" &&
-		c.APIv3Key == "" && c.AppID == "" && c.NotifyURL == ""
+		c.APIv3Key == "" && c.AppID == "" && c.NotifyURL == "" &&
+		c.PublicKeyPath == "" && c.PublicKeyID == ""
 }
 
-// missing 返回缺失字段名（配置不全时给 admin 一句能看懂的原因）。
+// missing 返回缺失字段名（配置不全时给 admin 一句能看懂的原因）。八项全必填：
+// APIv3 密钥用于回调资源解密，公钥两项用于验签。
 func (c Config) missing() []string {
 	var out []string
 	for _, f := range []struct{ k, v string }{
 		{"mchid", c.MchID}, {"cert_serial", c.CertSerial}, {"private_key_path", c.PrivateKeyPath},
 		{"apiv3_key", c.APIv3Key}, {"appid", c.AppID}, {"notify_url", c.NotifyURL},
+		{"public_key_path", c.PublicKeyPath}, {"public_key_id", c.PublicKeyID},
 	} {
 		if strings.TrimSpace(f.v) == "" {
 			out = append(out, f.k)
@@ -51,6 +58,8 @@ func ConfigFromEnv() Config {
 		APIv3Key:       os.Getenv("WECHAT_APIV3_KEY"),
 		AppID:          os.Getenv("WECHAT_APPID"),
 		NotifyURL:      os.Getenv("WECHAT_NOTIFY_URL"),
+		PublicKeyPath:  os.Getenv("WECHAT_PUBLIC_KEY"),
+		PublicKeyID:    os.Getenv("WECHAT_PUBLIC_KEY_ID"),
 	}
 }
 
diff --git a/sundynix-gateway/internal/payment/wechat.go b/sundynix-gateway/internal/payment/wechat.go
index 2d765f9..b66334c 100644
--- a/sundynix-gateway/internal/payment/wechat.go
+++ b/sundynix-gateway/internal/payment/wechat.go
@@ -5,13 +5,13 @@ package payment
 
 import (
 	"context"
+	"crypto/rsa"
 	"errors"
 	"fmt"
 	"net/http"
 
 	"github.com/wechatpay-apiv3/wechatpay-go/core"
 	"github.com/wechatpay-apiv3/wechatpay-go/core/auth/verifiers"
-	"github.com/wechatpay-apiv3/wechatpay-go/core/downloader"
 	"github.com/wechatpay-apiv3/wechatpay-go/core/notify"
 	"github.com/wechatpay-apiv3/wechatpay-go/core/option"
 	"github.com/wechatpay-apiv3/wechatpay-go/services/payments"
@@ -29,21 +29,31 @@ type Wechat struct {
 	apiv3Key  string
 	client    *core.Client
 	svc       native.NativeApiService
+	pubKey    *rsa.PublicKey // 微信支付公钥（验签回调用；构造时必填）
+	pubKeyID  string
 }
 
-// New 按完整配置装配微信渠道（私钥从磁盘路径加载；调用方保证字段齐全）。
+// New 按完整配置装配微信渠道（商户私钥/微信支付公钥都从磁盘路径加载；调用方保证字段齐全）。
+// 验签体系钉死「微信支付公钥」模式（WithWechatPayPublicKeyAuthCipher）：本项目商户
+// 2025-09 开户，只有公钥体系；老商户的平台证书模式（AutoAuthCipher）不支持。
 func New(ctx context.Context, c Config) (*Wechat, error) {
 	priv, err := utils.LoadPrivateKeyWithPath(c.PrivateKeyPath)
 	if err != nil {
 		return nil, fmt.Errorf("商户私钥加载失败(%s): %w", c.PrivateKeyPath, err)
 	}
-	client, err := core.NewClient(ctx, option.WithWechatPayAutoAuthCipher(c.MchID, c.CertSerial, priv, c.APIv3Key))
+	pub, err := utils.LoadPublicKeyWithPath(c.PublicKeyPath)
+	if err != nil {
+		return nil, fmt.Errorf("微信支付公钥加载失败(%s): %w", c.PublicKeyPath, err)
+	}
+	client, err := core.NewClient(ctx,
+		option.WithWechatPayPublicKeyAuthCipher(c.MchID, c.CertSerial, priv, c.PublicKeyID, pub))
 	if err != nil {
 		return nil, fmt.Errorf("客户端初始化失败: %w", err)
 	}
 	return &Wechat{
 		mchID: c.MchID, appID: c.AppID, notifyURL: c.NotifyURL, apiv3Key: c.APIv3Key,
 		client: client, svc: native.NativeApiService{Client: client},
+		pubKey: pub, pubKeyID: c.PublicKeyID,
 	}, nil
 }
 
@@ -111,11 +121,11 @@ func (w *Wechat) QueryOrder(ctx context.Context, orderID string) (QueryResult, e
 	return fromTransaction(t), nil
 }
 
-// VerifyCallback 验签 + 解密支付回调（APIv3：平台证书验签、AES-GCM 解密资源）。
+// VerifyCallback 验签 + 解密支付回调（微信支付公钥验签 + APIv3 密钥 AES-GCM 解密资源）。
 // 验签失败一律拒绝——回调路由是公开的，签名是唯一的门。
 func (w *Wechat) VerifyCallback(req *http.Request) (QueryResult, error) {
-	certVisitor := downloader.MgrInstance().GetCertificateVisitor(w.mchID)
-	h, err := notify.NewRSANotifyHandler(w.apiv3Key, verifiers.NewSHA256WithRSAVerifier(certVisitor))
+	h, err := notify.NewRSANotifyHandler(w.apiv3Key,
+		verifiers.NewSHA256WithRSAPubkeyVerifier(w.pubKeyID, *w.pubKey))
 	if err != nil {
 		return QueryResult{}, fmt.Errorf("回调处理器初始化失败: %w", err)
 	}
diff --git a/sundynix-gateway/internal/store/setting.go b/sundynix-gateway/internal/store/setting.go
index 9ed1a24..17cbc8f 100644
--- a/sundynix-gateway/internal/store/setting.go
+++ b/sundynix-gateway/internal/store/setting.go
@@ -11,7 +11,7 @@ import (
 type Setting struct {
 	BaseModel
 	Key   string `gorm:"size:64;uniqueIndex"`
-	Value string `gorm:"size:255"`
+	Value string `gorm:"type:text"` // 曾是 varchar(255)：支付配置 JSON(含加密密钥)一条就超,live 撞过 22001
 }
 
 func (Setting) TableName() string { return "sundynix_setting" }