diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..f246c7b
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,2 @@
+# 微信域名校验文件必须与公众平台下载包字节完全一致（禁止 CRLF / 尾换行）
+public/MP_verify_*.txt binary
diff --git a/nginx-default.conf b/nginx-default.conf
index 7814ccf..4e7e55a 100644
--- a/nginx-default.conf
+++ b/nginx-default.conf
@@ -420,6 +420,14 @@ server {
         add_header Expires "0";
     }
 
+    # 微信 JS 安全域名校验：原样返回 txt，禁止 SPA 回落 index.html
+    location ~* ^/MP_verify_[A-Za-z0-9]+\.txt$ {
+        default_type text/plain;
+        charset off;
+        add_header Cache-Control "no-store";
+        try_files $uri =404;
+    }
+
     # ============ 静态资源缓存 ============
 
     location ~* \.(?:js|css)$ {
diff --git a/nginx-k3s.conf b/nginx-k3s.conf
index 9ef5d41..6646a5d 100644
--- a/nginx-k3s.conf
+++ b/nginx-k3s.conf
@@ -160,6 +160,14 @@ server {
         add_header Expires "0";
     }
 
+    # 微信 JS 安全域名校验：原样返回 txt，禁止 SPA 回落 index.html
+    location ~* ^/MP_verify_[A-Za-z0-9]+\.txt$ {
+        default_type text/plain;
+        charset off;
+        add_header Cache-Control "no-store";
+        try_files $uri =404;
+    }
+
     location ~* \.(?:js|css)$ {
         try_files $uri =404;
         expires 1y;
diff --git a/public/MP_verify_t0yrk6yNYOjmAe8m.txt b/public/MP_verify_t0yrk6yNYOjmAe8m.txt
index a4fdebd..8df6b41 100644
Binary files a/public/MP_verify_t0yrk6yNYOjmAe8m.txt and b/public/MP_verify_t0yrk6yNYOjmAe8m.txt differ