diff --git a/par-core/src/main/java/com/par/core/storage/QiniuStorageService.java b/par-core/src/main/java/com/par/core/storage/QiniuStorageService.java
index 1417443..97c2d41 100644
--- a/par-core/src/main/java/com/par/core/storage/QiniuStorageService.java
+++ b/par-core/src/main/java/com/par/core/storage/QiniuStorageService.java
@@ -5,6 +5,7 @@ import com.qiniu.http.Client;
 import com.qiniu.http.Response;
 import com.qiniu.storage.BucketManager;
 import com.qiniu.storage.Configuration;
+import com.qiniu.storage.DownloadUrl;
 import com.qiniu.storage.Region;
 import com.qiniu.storage.UploadManager;
 import com.qiniu.util.Auth;
@@ -13,7 +14,7 @@ import org.springframework.stereotype.Service;
 
 /**
  * 七牛云存储。
- * 每次调用时从环境变量读取配置，支持热更新无需重启。
+ * 上传使用 UploadManager，下载使用 DownloadUrl + Auth 签名。
  */
 @Slf4j
 @Service
@@ -25,6 +26,7 @@ public class QiniuStorageService implements StorageService {
     private Auth auth;
     private String bucket;
     private String downloadDomain;
+    private boolean useHttps;
 
     private synchronized void ensureInit() {
         if (bucket != null) return;
@@ -33,8 +35,9 @@ public class QiniuStorageService implements StorageService {
         String regionStr = env("QINIU_REGION", "z2");
         this.bucket = env("QINIU_BUCKET", "par-configs");
         this.auth = Auth.create(ak, sk);
-        this.downloadDomain = env("QINIU_DOWNLOAD_DOMAIN",
-                "http://" + bucket + ".qiniudn.com");
+        // 七牛分配或自定义的下载域名
+        this.downloadDomain = env("QINIU_DOWNLOAD_DOMAIN", bucket + ".qiniudn.com");
+        this.useHttps = "true".equalsIgnoreCase(env("QINIU_DOWNLOAD_HTTPS", "false"));
         Region region = switch (regionStr) {
             case "z0" -> Region.region0();
             case "z1" -> Region.region1();
@@ -47,7 +50,7 @@ public class QiniuStorageService implements StorageService {
         this.uploadManager = new UploadManager(cfg);
         this.bucketManager = new BucketManager(auth, cfg);
         this.qiniuClient = new Client(cfg);
-        log.info("Qiniu 存储就绪: bucket={}, downloadDomain={}", bucket, downloadDomain);
+        log.info("Qiniu 存储就绪: bucket={}, domain={}", bucket, downloadDomain);
     }
 
     @Override
@@ -65,19 +68,26 @@ public class QiniuStorageService implements StorageService {
     @Override
     public String read(String path) {
         ensureInit();
-        // 通过 SDK Client + downloadDomain 私密下载
-        if (downloadDomain == null) {
-            log.warn("Qiniu 读取失败: QINIU_DOWNLOAD_DOMAIN 未配置");
-            return null;
-        }
-        String baseUrl = downloadDomain + "/" + path;
-        String signedUrl = auth.privateDownloadUrl(baseUrl, 3600);
+        // 先用 SDK stat 确认文件存在
         try {
+            if (bucketManager.stat(bucket, path) == null) {
+                log.warn("Qiniu 文件不存在: {}", path);
+                return null;
+            }
+        } catch (QiniuException e) {
+            log.warn("Qiniu stat 失败 {}: {}", path, e.response != null ? e.response.error : e.getMessage());
+        }
+
+        // 用 DownloadUrl 生成带签名的下载链接，SDK Client 下载
+        long deadline = System.currentTimeMillis() / 1000 + 3600;
+        try {
+            DownloadUrl url = new DownloadUrl(downloadDomain, useHttps, path);
+            String signedUrl = url.buildURL(auth, deadline);
             Response resp = qiniuClient.get(signedUrl);
             if (resp.isOK()) return resp.bodyString();
-            log.warn("Qiniu 读取失败 {}: HTTP {} (domain={})", path, resp.statusCode, downloadDomain);
+            log.warn("Qiniu 下载失败 {}: HTTP {}", path, resp.statusCode);
         } catch (QiniuException e) {
-            log.warn("Qiniu 读取失败 {}: {}", path, e.response != null ? e.response.error : e.getMessage());
+            log.warn("Qiniu 下载失败 {}: {}", path, e.response != null ? e.response.error : e.getMessage());
         }
         return null;
     }