diff --git a/manifest/config/config.example.yaml b/manifest/config/config.example.yaml
index 2d34771..e60b232 100644
--- a/manifest/config/config.example.yaml
+++ b/manifest/config/config.example.yaml
@@ -5,12 +5,20 @@ server:
   address:     ":18888"
   serverAgent: "team-api"
   dumpRouterMap: false
+  gracefulShutdownTimeout: 30
 
 # Logger
 logger:
   level:  "all"
   stdout: true
   ctxKeys: ["RequestId"]
+  # path: "./logs"             # 取消注释并设置路径即可落盘，Docker 建议用 /app/logs
+  # file: "{Y-m-d}.log"
+  # rotateSize: "100MB"
+  # rotateExpire: "1d"
+  # rotateBackupLimit: 30
+  # rotateBackupExpire: "30d"
+  # rotateBackupCompress: 9
 
 # Database (PostgreSQL)
 database:
diff --git a/manifest/deploy/kustomize/overlays/develop/configmap.yaml b/manifest/deploy/kustomize/overlays/develop/configmap.yaml
index 3b1d0af..17bd2fd 100644
--- a/manifest/deploy/kustomize/overlays/develop/configmap.yaml
+++ b/manifest/deploy/kustomize/overlays/develop/configmap.yaml
@@ -12,3 +12,6 @@ data:
     logger:
       level : "all"
       stdout: true
+
+    crypto:
+      encryptionKey: ""  # 必填：运行 openssl rand -hex 32 生成，与其他环境隔离
diff --git a/manifest/docker/config.example.yaml b/manifest/docker/config.example.yaml
index 40100d4..5d0cc04 100644
--- a/manifest/docker/config.example.yaml
+++ b/manifest/docker/config.example.yaml
@@ -17,12 +17,20 @@ server:
   dumpRouterMap: false
   accessLogEnabled: true
   errorLogEnabled: true
+  gracefulShutdownTimeout: 30
 
 # 日志配置
 logger:
   level: "all"
   stdout: true
   ctxKeys: ["RequestId"]
+  path: "/app/logs"           # Docker 部署时写入挂载卷，留空则只输出到 stdout
+  file: "{Y-m-d}.log"         # 按日期分文件
+  rotateSize: "100MB"         # 单文件超 100MB 触发轮转
+  rotateExpire: "1d"          # 每天轮转一次（取先到者）
+  rotateBackupLimit: 30       # 最多保留 30 个备份
+  rotateBackupExpire: "30d"   # 备份文件超 30 天自动删除
+  rotateBackupCompress: 9     # 备份文件 gzip 压缩（0=不压缩，9=最大压缩）
 
 # 数据库配置（PostgreSQL）
 # 连接地址中的 postgres 是 docker-compose 中的服务名
@@ -59,6 +67,12 @@ jwt:
   adminMaxSessions: 5
   tenantMaxSessions: 10
 
+# 加密配置（AES-256 密钥，32 字节 hex 编码 = 64 个十六进制字符）
+# 用于加密存储 API Key 原值、渠道密钥等敏感字段
+# 生成命令：openssl rand -hex 32
+crypto:
+  encryptionKey: "请修改：运行 openssl rand -hex 32 生成 64 位十六进制密钥"  # 请修改
+
 # 邮件 SMTP 配置（可选，用于邮箱验证码等功能）
 email:
   smtp: