diff --git a/file-service/src/main/java/com/xuqm/file/config/SecurityConfig.java b/file-service/src/main/java/com/xuqm/file/config/SecurityConfig.java
index f9792da..e92ea85 100644
--- a/file-service/src/main/java/com/xuqm/file/config/SecurityConfig.java
+++ b/file-service/src/main/java/com/xuqm/file/config/SecurityConfig.java
@@ -36,12 +36,12 @@ public class SecurityConfig {
             .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
             .authorizeHttpRequests(auth -> auth
                 .requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
-                // Public: serve files by hash and thumbnails (GET only — upload requires auth)
-                .requestMatchers(HttpMethod.GET, "/api/file/*/thumbnail").permitAll()
-                .requestMatchers(HttpMethod.GET, "/api/file/*").permitAll()
+                // Public: file upload and serving by hash (upload is intentionally public)
+                .requestMatchers("/api/file/upload").permitAll()
+                .requestMatchers("/api/file/*/thumbnail").permitAll()
+                .requestMatchers("/api/file/*").permitAll()
                 // Actuator health & info
                 .requestMatchers("/actuator/**").permitAll()
-                // Everything else (including POST /api/file/upload) requires authentication
                 .anyRequest().authenticated()
             )
             .exceptionHandling(ex -> ex