diff --git a/scripts/update.sh b/scripts/update.sh
index 7d3d520..8720c71 100755
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -104,6 +104,21 @@ set -a
 . "$ROOT_DIR/config/secrets.env"
 set +a
 
+# 迁移：旧版 secrets.env 没有 Spring 直接读取的 env 名，补齐以防 docker compose
+# 变量替换失败时覆盖成空字符串（deploy.sh 新建部署已自动写入，此处仅升级兼容）
+_patched=0
+if ! grep -q "^SPRING_DATASOURCE_PASSWORD=" "$ROOT_DIR/config/secrets.env" 2>/dev/null; then
+  _mp="$(grep '^MYSQL_PASSWORD=' "$ROOT_DIR/config/secrets.env" | cut -d= -f2-)"
+  printf '\nSPRING_DATASOURCE_PASSWORD=%s\n' "$_mp" >> "$ROOT_DIR/config/secrets.env"
+  _patched=1
+fi
+if ! grep -q "^SPRING_DATA_REDIS_PASSWORD=" "$ROOT_DIR/config/secrets.env" 2>/dev/null; then
+  _rp="$(grep '^REDIS_PASSWORD=' "$ROOT_DIR/config/secrets.env" | cut -d= -f2-)"
+  printf 'SPRING_DATA_REDIS_PASSWORD=%s\n' "$_rp" >> "$ROOT_DIR/config/secrets.env"
+  _patched=1
+fi
+[ "$_patched" -eq 1 ] && ok "secrets.env 已补齐 SPRING_DATASOURCE_PASSWORD / SPRING_DATA_REDIS_PASSWORD"
+
 _CONSOLE_DOMAIN="$(grep '^CONSOLE_DOMAIN=' "$ROOT_DIR/config/xuqm.env" 2>/dev/null \
   | cut -d= -f2- | tr -d '"' | tr -d "'")"
 _NGINX_BIND="${NGINX_BIND:-80}"