diff --git a/yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/framework/monitor/config/AdminServerConfiguration.java b/yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/framework/monitor/config/AdminServerConfiguration.java
index 02068c5..2fb726e 100644
--- a/yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/framework/monitor/config/AdminServerConfiguration.java
+++ b/yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/framework/monitor/config/AdminServerConfiguration.java
@@ -40,6 +40,10 @@ public class AdminServerConfiguration {
     @Value("${spring.boot.admin.client.password:admin}")
     private String password;
 
+    // 新增：注入允许的 frame 嵌入域名
+    @Value("${spring.boot.admin.frame-ancestors:'self'}")
+    private String frameAncestors;
+
     /**
      * Spring Boot Admin 专用的 InMemoryUserDetailsManager
      * 使用内存存储，与系统用户隔离
@@ -100,6 +104,14 @@ public class AdminServerConfiguration {
                                 adminSeverContextPath + "/instances", // Admin Client 注册端点忽略 CSRF
                                 adminSeverContextPath + "/actuator/**" // Actuator 端点忽略 CSRF
                         )
+                )// 修正后的 headers 配置（替换原来报错的代码）
+                .headers(headers -> headers
+                        // 关键修正：传入合法的基础 CSP 指令，而非空字符串
+                        .contentSecurityPolicy(csp -> csp.policyDirectives(
+                                "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-ancestors " + frameAncestors )
+                        )
+                        .frameOptions(frame -> frame.sameOrigin()) // 显式设置 X-Frame-Options 为 SAMEORIGIN
+                        .cacheControl(cache -> cache.disable()) // 禁用缓存，避免旧配置生效
                 );
         return httpSecurity.build();
     }
diff --git a/yudao-server/src/main/resources/application-local.yaml b/yudao-server/src/main/resources/application-local.yaml
index f4e9da8..3be3233 100644
--- a/yudao-server/src/main/resources/application-local.yaml
+++ b/yudao-server/src/main/resources/application-local.yaml
@@ -163,6 +163,8 @@ spring:
         password: admin
       # Spring Boot Admin Server 服务端的相关配置
       context-path: /admin # 配置 Spring
+      # 允许嵌入 iframe 的域名（支持通配符），实际部署时，可以改为 "'self' [你的公网域名]"
+      frame-ancestors: "'self' localhost localhost:48080 127.0.0.1 127.0.0.1:48080"
 
 # 日志文件配置
 logging: