diff --git a/src/Application/TakeoutSaaS.Application/Identity/Contracts/UserListItemDto.cs b/src/Application/TakeoutSaaS.Application/Identity/Contracts/UserListItemDto.cs
index fb818b6..c3f0abc 100644
--- a/src/Application/TakeoutSaaS.Application/Identity/Contracts/UserListItemDto.cs
+++ b/src/Application/TakeoutSaaS.Application/Identity/Contracts/UserListItemDto.cs
@@ -31,6 +31,11 @@ public sealed record UserListItemDto
     /// </summary>
     public string DisplayName { get; init; } = string.Empty;
 
+    /// <summary>
+    /// 头像地址。
+    /// </summary>
+    public string? Avatar { get; init; }
+
     /// <summary>
     /// 手机号。
     /// </summary>
diff --git a/src/Application/TakeoutSaaS.Application/Identity/Handlers/BatchIdentityUserOperationCommandHandler.cs b/src/Application/TakeoutSaaS.Application/Identity/Handlers/BatchIdentityUserOperationCommandHandler.cs
index 31f4ddc..04ee470 100644
--- a/src/Application/TakeoutSaaS.Application/Identity/Handlers/BatchIdentityUserOperationCommandHandler.cs
+++ b/src/Application/TakeoutSaaS.Application/Identity/Handlers/BatchIdentityUserOperationCommandHandler.cs
@@ -196,6 +196,7 @@ public sealed class BatchIdentityUserOperationCommandHandler(
                 TenantId = user.TenantId,
                 Account = user.Account,
                 DisplayName = user.DisplayName,
+                Avatar = user.Avatar,
                 Phone = user.Phone,
                 Email = user.Email,
                 Status = user.Status,
diff --git a/src/Application/TakeoutSaaS.Application/Identity/Handlers/SearchIdentityUsersQueryHandler.cs b/src/Application/TakeoutSaaS.Application/Identity/Handlers/SearchIdentityUsersQueryHandler.cs
index 3a16d80..2b880c3 100644
--- a/src/Application/TakeoutSaaS.Application/Identity/Handlers/SearchIdentityUsersQueryHandler.cs
+++ b/src/Application/TakeoutSaaS.Application/Identity/Handlers/SearchIdentityUsersQueryHandler.cs
@@ -75,6 +75,7 @@ public sealed class SearchIdentityUsersQueryHandler(
             TenantId = user.TenantId,
             Account = user.Account,
             DisplayName = user.DisplayName,
+            Avatar = user.Avatar,
             Phone = user.Phone,
             Email = user.Email,
             Status = user.Status,
diff --git a/src/Application/TakeoutSaaS.Application/Storage/Services/FileStorageService.cs b/src/Application/TakeoutSaaS.Application/Storage/Services/FileStorageService.cs
index a887bf9..17eb087 100644
--- a/src/Application/TakeoutSaaS.Application/Storage/Services/FileStorageService.cs
+++ b/src/Application/TakeoutSaaS.Application/Storage/Services/FileStorageService.cs
@@ -54,11 +54,11 @@ public sealed class FileStorageService(
 
         // 4. 上传到对象存储
         var uploadResult = await provider.UploadAsync(
-            new StorageUploadRequest(objectKey, request.Content, contentType, request.ContentLength, true, expires, metadata),
+            new StorageUploadRequest(objectKey, request.Content, contentType, request.ContentLength, false, expires, metadata),
             cancellationToken).ConfigureAwait(false);
 
-        // 5. 追加防盗链签名并返回
-        var finalUrl = AppendAntiLeechToken(uploadResult.SignedUrl ?? uploadResult.Url, objectKey, expires, security);
+        // 5. 构造公开访问链接并返回
+        var finalUrl = provider.BuildPublicUrl(uploadResult.ObjectKey);
         logger.LogInformation("文件上传成功：{ObjectKey} ({Size} bytes)", objectKey, request.ContentLength);
 
         return new FileUploadResponse