diff --git a/server/git-sync/server.js b/server/git-sync/server.js
index b79b920..aa24866 100644
--- a/server/git-sync/server.js
+++ b/server/git-sync/server.js
@@ -29,7 +29,14 @@ const fs = require("fs");
 const path = require("path");
 
 const app = express();
-app.use(express.json({ limit: "1mb" }));
+
+// 捕获 raw body 用于 Webhook 签名验证
+app.use(express.json({
+  limit: "1mb",
+  verify: (req, _res, buf) => {
+    req.rawBody = buf.toString("utf8");
+  }
+}));
 
 // ─── 配置 ─────────────────────────────────────────────────────
 const CONFIG = {
@@ -201,7 +208,8 @@ async function syncWithRetry(commitSha, committer, message) {
 // Webhook 接收端点
 app.post("/webhook", async (req, res) => {
   const signature = req.headers["x-gitea-signature"] || req.headers["x-hub-signature-256"] || "";
-  const payload = JSON.stringify(req.body);
+  // 使用 raw body 验证签名（Express JSON 解析后 stringify 会和原始 body 不一致）
+  const payload = req.rawBody || JSON.stringify(req.body);
 
   // 验证签名
   if (!verifyWebhook(payload, signature)) {