diff --git a/par-api/src/main/resources/application.yml b/par-api/src/main/resources/application.yml
index 65ecdb2..d88801c 100644
--- a/par-api/src/main/resources/application.yml
+++ b/par-api/src/main/resources/application.yml
@@ -5,16 +5,17 @@ spring:
   application:
     name: par-server
   datasource:
-    url: jdbc:mysql://localhost:3306/par_registry?useUnicode=true&characterEncoding=utf-8&serverTimezone=Asia/Shanghai
-    username: ${MYSQL_USER:par}
-    password: ${MYSQL_PASSWORD:par123}
+    url: jdbc:mysql://${MYSQL_HOST:localhost}:${MYSQL_PORT:3306}/${MYSQL_DB:par_registry}?useUnicode=true&characterEncoding=utf-8&serverTimezone=Asia/Shanghai&useSSL=false&allowPublicKeyRetrieval=true
+    username: ${MYSQL_USER:root}
+    password: ${MYSQL_PASSWORD:root}
     driver-class-name: com.mysql.cj.jdbc.Driver
     hikari:
-      maximum-pool-size: 20
       minimum-idle: 5
+      maximum-pool-size: 20
       connection-timeout: 30000
       idle-timeout: 600000
       max-lifetime: 1800000
+      connection-init-sql: SET SESSION lock_wait_timeout=10
 
   jackson:
     date-format: yyyy-MM-dd HH:mm:ss
@@ -23,7 +24,7 @@ spring:
 
   web:
     resources:
-      static-locations: file:${par.static.path:./static/}
+      static-locations: file:${PAR_STATIC_PATH:./static/}
 
   flyway:
     enabled: true
@@ -56,6 +57,10 @@ par:
     login-max-failures: 5
     login-lock-minutes: 30
 
+# HMAC 签名密钥（生产环境必须配置随机密钥）
+hmac:
+  secret: ${HMAC_SECRET:}
+
 logging:
   level:
     com.par: DEBUG