diff --git a/backend/seed/seed.go b/backend/seed/seed.go
index 082da98..9d8b5b2 100644
--- a/backend/seed/seed.go
+++ b/backend/seed/seed.go
@@ -1,6 +1,7 @@
 package seed
 
 import (
+	"os"
 	"strings"
 
 	"ezops/model"
@@ -36,27 +37,33 @@ func SeedData(db *gorm.DB) {
 	}
 
 	// 2. 创建默认 LDAP 配置
+	// LDAP 管理密码只从环境变量 LDAP_ADMIN_PASSWORD 读取，不写入代码库
 	var ldapCount int64
 	db.Model(&model.LDAPConfig{}).Count(&ldapCount)
 	if ldapCount == 0 {
-		port := 389
-		useLDAPS := false
-		searchFilter := "(objectClass=inetOrgPerson)"
-		userMapping := `{"username":"uid","email":"mail","display_name":"cn"}`
-		ldapCfg := model.LDAPConfig{
-			LDAPHost:      "8.217.205.92",
-			LDAPPort:      &port,
-			UseLDAPS:      &useLDAPS,
-			AdminDN:       "cn=admin,dc=opsx,dc=vip",
-			AdminPassword: "LQl2GX7EEg2N",
-			BaseDN:        "dc=opsx,dc=vip",
-			SearchFilter:  &searchFilter,
-			UserMapping:   &userMapping,
-		}
-		if err := db.Create(&ldapCfg).Error; err != nil {
-			zap.L().Warn("failed to seed LDAP config", zap.Error(err))
+		ldapPassword := os.Getenv("LDAP_ADMIN_PASSWORD")
+		if ldapPassword == "" {
+			zap.L().Info("LDAP_ADMIN_PASSWORD 未设置，跳过 LDAP 默认配置初始化（请在页面手动配置）")
 		} else {
-			zap.L().Info("seeded default LDAP config (8.217.205.92:389)")
+			port := 389
+			useLDAPS := false
+			searchFilter := "(objectClass=inetOrgPerson)"
+			userMapping := `{"username":"uid","email":"mail","display_name":"cn"}`
+			ldapCfg := model.LDAPConfig{
+				LDAPHost:      "8.217.205.92",
+				LDAPPort:      &port,
+				UseLDAPS:      &useLDAPS,
+				AdminDN:       "cn=admin,dc=opsx,dc=vip",
+				AdminPassword: ldapPassword,
+				BaseDN:        "dc=opsx,dc=vip",
+				SearchFilter:  &searchFilter,
+				UserMapping:   &userMapping,
+			}
+			if err := db.Create(&ldapCfg).Error; err != nil {
+				zap.L().Warn("failed to seed LDAP config", zap.Error(err))
+			} else {
+				zap.L().Info("seeded default LDAP config (8.217.205.92:389)")
+			}
 		}
 	}