diff --git a/pom.xml b/pom.xml
index 049bd72..08f9462 100644
--- a/pom.xml
+++ b/pom.xml
@@ -203,6 +203,15 @@
             <resource>
                 <directory>src/main/resources</directory>
                 <filtering>true</filtering>
+                <excludes>
+                    <exclude>static/**</exclude>
+                </excludes>
+            </resource>
+            <resource>
+                <directory>src/main/resources/static</directory>
+                <!-- 必须指定 targetPath，否则文件会被平铺到 target/classes/ 根目录，而不是 target/classes/static/ -->
+                <targetPath>static</targetPath>
+                <filtering>false</filtering>
             </resource>
         </resources>
         <plugins>
diff --git a/src/main/java/com/wok/supportbot/security/JwtAuthFilter.java b/src/main/java/com/wok/supportbot/security/JwtAuthFilter.java
index f573702..504d168 100644
--- a/src/main/java/com/wok/supportbot/security/JwtAuthFilter.java
+++ b/src/main/java/com/wok/supportbot/security/JwtAuthFilter.java
@@ -63,13 +63,19 @@ public class JwtAuthFilter extends OncePerRequestFilter {
     }
 
     /**
-     * 跳过 SDK 路径 — 这些路径由 SdkAuthFilter 使用独立的 jwt.sdk-secret 验签，
-     * 不应由本 Filter 用管理后台密钥重复验证，避免产生误报 WARN 日志。
+     * 跳过 SDK 路径和静态资源路径 — 这些路径要么由 SdkAuthFilter 使用独立的 jwt.sdk-secret 验签，
+     * 要么是不需要认证的首页/前端资源，不应由本 Filter 用管理后台密钥重复验证，避免产生误报 WARN 日志。
      */
     @Override
     protected boolean shouldNotFilter(HttpServletRequest request) {
         String path = request.getServletPath();
-        return path.startsWith("/ai/");
+        return path.startsWith("/ai/")
+            || path.isEmpty() || path.equals("/")
+            || path.equals("/index.html")
+            || path.startsWith("/assets/")
+            || path.startsWith("/sdk/")
+            || path.equals("/favicon.ico")
+            || path.equals("/favicon.svg");
     }
 
     /**
diff --git a/src/main/java/com/wok/supportbot/security/SecurityConfig.java b/src/main/java/com/wok/supportbot/security/SecurityConfig.java
index 926d3bc..e850e1a 100644
--- a/src/main/java/com/wok/supportbot/security/SecurityConfig.java
+++ b/src/main/java/com/wok/supportbot/security/SecurityConfig.java
@@ -44,6 +44,9 @@ public class SecurityConfig {
             .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
             .authorizeHttpRequests(auth -> auth
                 // ========== 公开接口（无需认证） ==========
+                // 静态资源与首页（放在最前面，优先匹配）
+                .requestMatchers("/", "/index.html", "/favicon.ico", "/favicon.svg").permitAll()
+                .requestMatchers("/assets/**", "/sdk/**").permitAll()
                 // SDK 对话接口
                 // SdkAuthFilter 作为 Servlet Filter 已在 SecurityFilterChain 之前执行，
                 // 校验通过时已放行，校验失败时已返回 401，不会到达此处。