diff --git a/src/handlers/payment.rs b/src/handlers/payment.rs
index 101db78..8b621c8 100644
--- a/src/handlers/payment.rs
+++ b/src/handlers/payment.rs
@@ -710,7 +710,7 @@ pub async fn payment_page(
     let base_url = std::env::var("APP_BASE_URL")
         .unwrap_or_else(|_| "https://dev.xmclassmate.top".to_string());
     let notify_url = format!("{}/payment/notify", base_url);
-    let return_url = format!("{}/payment/success?order_no={}", base_url, order_no);
+    let return_url = format!("{}/payment/success?order_no={}&jwt={}", base_url, order_no, token);
 
     let Some(config) = AlipayConfig::from_env() else {
         let jwt_for_mock = token.clone();
@@ -935,9 +935,10 @@ pub async fn alipay_notify(
 #[derive(Debug, Deserialize)]
 pub struct AlipaySuccessQuery {
     pub order_no: Option<String>,
+    pub jwt: Option<String>,
 }
 
-fn build_success_html(order_no: &str) -> String {
+fn build_success_html(order_no: &str, jwt_token: &str) -> String {
     let green = "#52c41a";
     let white = "white";
     let orange = "#fa8c16";
@@ -988,7 +989,7 @@ fn build_success_html(order_no: &str) -> String {
     if (!orderNo) return;
     fetch('/api/payment/sync-order', {{
       method: 'POST',
-      headers: {{ 'Content-Type': 'application/json' }},
+      headers: {{ 'Content-Type': 'application/json', 'Authorization': 'Bearer {4}' }},
       body: JSON.stringify({{ order_id: orderNo }})
     }})
     .then(function(r){{ return r.json(); }})
@@ -1015,7 +1016,7 @@ fn build_success_html(order_no: &str) -> String {
 </script>
 </body>
 </html>"##,
-        green, white, order_no, orange
+        green, white, order_no, orange, jwt_token
     );
     html
 }
@@ -1042,11 +1043,12 @@ pub async fn payment_success(
     query: web::Query<AlipaySuccessQuery>,
 ) -> HttpResponse {
     let order_no = query.order_no.as_deref().unwrap_or("");
+    let jwt_token = query.jwt.as_deref().unwrap_or("");
 
     // 不再在此处确认订单（安全原因: 此端点无认证, 任何人知道 order_no 即可激活会员）。
     // Mock 支付由 mock_confirm 在跳转前确认, 真实支付宝由 notify 异步回调确认。
 
-    let html = build_success_html(order_no);
+    let html = build_success_html(order_no, jwt_token);
     HttpResponse::Ok()
         .content_type("text/html; charset=utf-8")
         .body(html)