diff --git a/backend/internal/deployment/recovery_preflight_sftp_test.go b/backend/internal/deployment/recovery_preflight_sftp_test.go
index 24a289e..98f3504 100644
--- a/backend/internal/deployment/recovery_preflight_sftp_test.go
+++ b/backend/internal/deployment/recovery_preflight_sftp_test.go
@@ -49,16 +49,17 @@ func TestRecoveryPreflightOverPasswordSFTP(t *testing.T) {
 				delete(r.Evidence.TemporaryFiles, r.TemporaryPaths[2])
 			}
 			for path, file := range memory.files {
+				localPath := localSFTPPath(root, path)
 				if strings.HasSuffix(path, ".scert-lock") {
-					if err := os.MkdirAll(path, 0o700); err != nil {
+					if err := os.MkdirAll(localPath, 0o700); err != nil {
 						t.Fatal(err)
 					}
 					continue
 				}
-				if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
+				if err := os.MkdirAll(filepath.Dir(localPath), 0o700); err != nil {
 					t.Fatal(err)
 				}
-				if err := os.WriteFile(path, file.data, 0o600); err != nil {
+				if err := os.WriteFile(localPath, file.data, 0o600); err != nil {
 					t.Fatal(err)
 				}
 			}
@@ -78,7 +79,7 @@ func TestRecoveryPreflightOverPasswordSFTP(t *testing.T) {
 					t.Fatal("真实 SFTP 恢复未完成")
 				}
 				for _, target := range r.Paths {
-					data, err := os.ReadFile(target)
+					data, err := os.ReadFile(localSFTPPath(root, target))
 					if err != nil || string(data) != "old" {
 						t.Fatalf("真实文件恢复错误：%s %v", target, err)
 					}
@@ -101,6 +102,16 @@ func TestRecoveryPreflightOverPasswordSFTP(t *testing.T) {
 	}
 }
 
+func localSFTPPath(root, remotePath string) string {
+	if volume := filepath.ToSlash(filepath.VolumeName(root)); volume != "" {
+		remoteVolume := "/" + volume
+		if strings.HasPrefix(remotePath, remoteVolume) {
+			return filepath.FromSlash(strings.TrimPrefix(remotePath, "/"))
+		}
+	}
+	return filepath.FromSlash(remotePath)
+}
+
 func snapshotRecoveryDirectory(t *testing.T, root string) map[string]string {
 	t.Helper()
 	result := map[string]string{}
diff --git a/backend/internal/deployment/recovery_preflight_test.go b/backend/internal/deployment/recovery_preflight_test.go
index 7910c38..5d0446a 100644
--- a/backend/internal/deployment/recovery_preflight_test.go
+++ b/backend/internal/deployment/recovery_preflight_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"maps"
+	"path"
 	"path/filepath"
 	"reflect"
 	"testing"
@@ -12,9 +13,10 @@ import (
 func recoveryPreflightFixture(roots ...string) (Server, *memoryClient, TransactionRecord) {
 	server := testServer("preflight").Normalize()
 	if len(roots) == 1 {
-		server.CertificatePath = filepath.ToSlash(filepath.Join(roots[0], "cert.pem"))
-		server.CertificateChainPath = filepath.ToSlash(filepath.Join(roots[0], "fullchain.pem"))
-		server.PrivateKeyPath = filepath.ToSlash(filepath.Join(roots[0], "key.pem"))
+		remoteRoot := "/" + filepath.ToSlash(roots[0])
+		server.CertificatePath = path.Join(remoteRoot, "cert.pem")
+		server.CertificateChainPath = path.Join(remoteRoot, "fullchain.pem")
+		server.PrivateKeyPath = path.Join(remoteRoot, "key.pem")
 	}
 	client := newMemoryClient()
 	r := TransactionRecord{
diff --git a/backend/internal/httpapi/certificate_import_async_test.go b/backend/internal/httpapi/certificate_import_async_test.go
index 8f11ba5..936bb81 100644
--- a/backend/internal/httpapi/certificate_import_async_test.go
+++ b/backend/internal/httpapi/certificate_import_async_test.go
@@ -10,6 +10,7 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"sync/atomic"
 	"testing"
@@ -60,7 +61,7 @@ func TestAsyncImportUploadLifecycle(t *testing.T) {
 						t.Errorf("上传文件被提前回收或内容变化：%v", err)
 					}
 					info, err := os.Stat(path)
-					if err != nil || info.Mode().Perm() != 0600 {
+					if err != nil || (runtime.GOOS != "windows" && info.Mode().Perm() != 0600) {
 						t.Errorf("上传文件权限错误：%v", err)
 					}
 				}