diff --git a/docker-compose.yaml b/docker-compose.yaml
index 5cd98599b..59d4bc306 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -22,7 +22,7 @@ services:
       # MCP settings
       SERVER_IMAGE_HOST: http://YOUR_SERVE_IP:MCP_PORT/images/
       # Auth & Security
-      SECRET_KEY: y5txe1mRmS_JpOrUzFzHEu-kIQn3lf7ll0AOv9DQh0s
+      SECRET_KEY: ${SECRET_KEY:?Set a unique SECRET_KEY in .env before starting SQLBot}
       # CORS settings
       BACKEND_CORS_ORIGINS: "http://localhost,http://localhost:5173,https://localhost,https://localhost:5173"
       # Logging
diff --git a/installer/install.conf b/installer/install.conf
index 42a58a7c6..0e15dff21 100644
--- a/installer/install.conf
+++ b/installer/install.conf
@@ -22,8 +22,8 @@ SQLBOT_DB_PASSWORD=Password123@pg
 # 其他配置
 ## 普通用户默认密码
 SQLBOT_DEFAULT_PWD=SQLBot@123456
-## SQLBot Secret Key
-SQLBOT_SECRET_KEY=y5txe1mRmS_JpOrUzFzHEu-kIQn3lf7ll0AOv9DQh0s
+## SQLBot Secret Key（留空时安装程序会生成并持久化随机密钥）
+SQLBOT_SECRET_KEY=
 ## Cross-Origin Resource Sharing (CORS) 设置
 SQLBOT_CORS_ORIGINS=http://localhost,http://localhost:5173,https://localhost,https://localhost:5173
 ## 日志级别 DEBUG, INFO, WARNING, ERROR
diff --git a/installer/install.sh b/installer/install.sh
index 3f277c53a..707f27931 100644
--- a/installer/install.sh
+++ b/installer/install.sh
@@ -21,6 +21,47 @@ function log_content () {
     log "\t${1}"
 }
 
+COMPROMISED_SECRET_KEY_SHA256='78682d15dcf21e49b462da00b3ab33355c095450e02e2b37ed601e08e1b799c5'
+
+function secret_key_fingerprint() {
+    printf '%s' "$1" | sha256sum | awk '{print $1}'
+}
+
+function prepare_secret_key() {
+    local current_fingerprint=''
+    local secret_action='generated'
+
+    if [[ -n "${SQLBOT_SECRET_KEY:-}" ]]; then
+        current_fingerprint=$(secret_key_fingerprint "${SQLBOT_SECRET_KEY}")
+    fi
+
+    if [[ "${current_fingerprint}" == "${COMPROMISED_SECRET_KEY_SHA256}" ]]; then
+        secret_action='rotated'
+        SQLBOT_SECRET_KEY=''
+    fi
+
+    if [[ -z "${SQLBOT_SECRET_KEY:-}" ]]; then
+        SQLBOT_SECRET_KEY=$(
+            LC_ALL=C tr -dc 'A-Za-z0-9_-' </dev/urandom | head -c 64
+        )
+        export SQLBOT_SECRET_KEY
+
+        if [[ "${#SQLBOT_SECRET_KEY}" -ne 64 ]]; then
+            log_content "生成 SQLBot Secret Key 失败"
+            exit 1
+        fi
+
+        if [[ "${secret_action}" == 'rotated' ]]; then
+            log_content "检测到已公开的 SQLBot Secret Key，已自动轮换，现有登录会话将失效"
+        else
+            log_content "已生成新的 SQLBot Secret Key"
+        fi
+    elif [[ "${#SQLBOT_SECRET_KEY}" -lt 32 ]]; then
+        log_content "SQLBOT_SECRET_KEY 长度不能少于 32 个字符"
+        exit 1
+    fi
+}
+
 function check_and_prepare_env_params() {
     log "当前时间 : $(date)"
     log_title "检查安装环境并初始化环境变量"
@@ -56,6 +97,7 @@ function check_and_prepare_env_params() {
         mkdir -p ${SQLBOT_BASE}
         log_content "全新安装"
     fi
+    prepare_secret_key
     set +a
 }
 
@@ -281,4 +323,6 @@ function main() {
     start_sqlbot
 }
 
-main
+if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+    main
+fi