diff --git a/crates/erp-health/src/oauth/handler.rs b/crates/erp-health/src/oauth/handler.rs
index c0b216d..ebc30e7 100644
--- a/crates/erp-health/src/oauth/handler.rs
+++ b/crates/erp-health/src/oauth/handler.rs
@@ -18,8 +18,16 @@ pub async fn token(
     State(state): State<HealthState>,
     Json(req): Json<TokenRequest>,
 ) -> Result<(StatusCode, Json<TokenResponse>), (StatusCode, Json<TokenErrorResponse>)> {
-    let jwt_secret = std::env::var("ERP__AUTH__JWT_SECRET")
-        .expect("ERP__AUTH__JWT_SECRET 环境变量未设置 — 无法签发 OAuth token");
+    let jwt_secret = match std::env::var("ERP__AUTH__JWT_SECRET") {
+        Ok(s) => s,
+        Err(_) => {
+            tracing::error!("ERP__AUTH__JWT_SECRET 环境变量未设置 — 无法签发 OAuth token");
+            return Err((
+                StatusCode::INTERNAL_SERVER_ERROR,
+                Json(TokenErrorResponse::invalid_client("服务配置错误")),
+            ));
+        }
+    };
 
     match OAuthService::token(&state.db, &req, &jwt_secret).await {
         Ok(resp) => Ok((StatusCode::OK, Json(resp))),