diff --git a/yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/framework/monitor/config/AdminServerConfiguration.java b/yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/framework/monitor/config/AdminServerConfiguration.java
index 2fb726e..fc33ce1 100644
--- a/yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/framework/monitor/config/AdminServerConfiguration.java
+++ b/yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/framework/monitor/config/AdminServerConfiguration.java
@@ -9,6 +9,7 @@ import org.springframework.context.annotation.Configuration;
 import org.springframework.core.annotation.Order;
 import org.springframework.security.config.Customizer;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
 import org.springframework.security.core.userdetails.User;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.crypto.password.PasswordEncoder;
@@ -40,7 +41,6 @@ public class AdminServerConfiguration {
     @Value("${spring.boot.admin.client.password:admin}")
     private String password;
 
-    // 新增：注入允许的 frame 嵌入域名
     @Value("${spring.boot.admin.frame-ancestors:'self'}")
     private String frameAncestors;
 
@@ -104,14 +104,16 @@ public class AdminServerConfiguration {
                                 adminSeverContextPath + "/instances", // Admin Client 注册端点忽略 CSRF
                                 adminSeverContextPath + "/actuator/**" // Actuator 端点忽略 CSRF
                         )
-                )// 修正后的 headers 配置（替换原来报错的代码）
+                )
                 .headers(headers -> headers
-                        // 关键修正：传入合法的基础 CSP 指令，而非空字符串
+                        // 特殊：Spring Boot Admin 前端基于 Vue，需 unsafe-inline ／ unsafe-eval 支持内联脚本与表达式
                         .contentSecurityPolicy(csp -> csp.policyDirectives(
-                                "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-ancestors " + frameAncestors )
-                        )
-                        .frameOptions(frame -> frame.sameOrigin()) // 显式设置 X-Frame-Options 为 SAMEORIGIN
-                        .cacheControl(cache -> cache.disable()) // 禁用缓存，避免旧配置生效
+                                "default-src 'self'; "
+                                        + "script-src 'self' 'unsafe-inline' 'unsafe-eval'; "
+                                        + "style-src 'self' 'unsafe-inline'; "
+                                        + "frame-ancestors " + frameAncestors))
+                        .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin) // 显式设置 X-Frame-Options 为 SAMEORIGIN
+                        .cacheControl(HeadersConfigurer.CacheControlConfig::disable) // 禁用缓存，避免旧配置生效
                 );
         return httpSecurity.build();
     }