diff --git a/app/services/grok/services/assets.py b/app/services/grok/services/assets.py
index cfcf62a..9197f85 100644
--- a/app/services/grok/services/assets.py
+++ b/app/services/grok/services/assets.py
@@ -155,10 +155,13 @@ class BaseService:
         """构建请求头"""
         if download:
             headers = {
-                "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+                "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
                 "Sec-Fetch-Dest": "document",
                 "Sec-Fetch-Mode": "navigate",
+                "Sec-Fetch-Site": "same-site",
+                "Sec-Fetch-User": "?1",
                 "Referer": referer,
+                "User-Agent": self.config.user_agent,
             }
         else:
             headers = {
diff --git a/app/services/grok/services/image.py b/app/services/grok/services/image.py
index 089a5f0..573e1a2 100644
--- a/app/services/grok/services/image.py
+++ b/app/services/grok/services/image.py
@@ -3,6 +3,7 @@ Grok Imagine WebSocket image service.
 """
 
 import asyncio
+import certifi
 import json
 import re
 import ssl
@@ -30,6 +31,7 @@ class ImageService:
 
     def __init__(self):
         self._ssl_context = ssl.create_default_context()
+        self._ssl_context.load_verify_locations(certifi.where())
         self._url_pattern = re.compile(r"/images/([a-f0-9-]+)\.(png|jpg|jpeg)")
 
     def _resolve_proxy(self) -> tuple[aiohttp.BaseConnector, Optional[str]]: