diff --git a/backend/controllers/security.go b/backend/controllers/security.go
index 6fae27d..378fff7 100644
--- a/backend/controllers/security.go
+++ b/backend/controllers/security.go
@@ -164,12 +164,18 @@ func LoadSecurityContext(ctx *context.Context) {
 
 func credentialRuntime() *credentials.Service {
 	if service := currentSecurityRuntime().credentials; service != nil {
+		if service.VaultRoot() == "" && config.ROOT_PATH != "" {
+			service.SetVaultRoot(config.ROOT_PATH)
+		}
 		return service
 	}
 	if db.Instance == nil {
 		return nil
 	}
 	service, _ := credentials.NewService(db.Instance)
+	if service != nil && config.ROOT_PATH != "" {
+		service.SetVaultRoot(config.ROOT_PATH)
+	}
 	return service
 }
 
diff --git a/backend/services/credentials/protocol.go b/backend/services/credentials/protocol.go
index 26baf4d..6c54756 100644
--- a/backend/services/credentials/protocol.go
+++ b/backend/services/credentials/protocol.go
@@ -32,6 +32,7 @@ type ProtocolCredentialStatus struct {
 	Protocol   string     `json:"protocol"`
 	Enabled    bool       `json:"enabled"`
 	Configured bool       `json:"configured"`
+	CanReveal  bool       `json:"can_reveal"`
 	CreatedAt  *time.Time `json:"created_at,omitempty"`
 	UpdatedAt  *time.Time `json:"updated_at,omitempty"`
 	LastUsedAt *time.Time `json:"last_used_at,omitempty"`
@@ -75,6 +76,7 @@ func (s *Service) ListProtocolCredentials(userID int) ([]ProtocolCredentialStatu
 			updatedAt := item.UpdatedAt
 			status.Enabled = item.Enabled
 			status.Configured = item.CodeHash != "" && item.RevokedAt == nil
+			status.CanReveal = item.CodeCiphertext != "" && item.RevokedAt == nil
 			status.CreatedAt = &createdAt
 			status.UpdatedAt = &updatedAt
 			status.LastUsedAt = item.LastUsedAt
@@ -255,11 +257,12 @@ func (s *Service) RevealProtocolCodes(userID int) (map[string]string, error) {
 	if userID <= 0 {
 		return nil, ErrInvalidUser
 	}
-	if s.vaultRoot == "" {
-		return make(map[string]string), nil
-	}
 	s.mu.Lock()
 	defer s.mu.Unlock()
+	vaultRoot := s.vaultRoot
+	if vaultRoot == "" {
+		return make(map[string]string), nil
+	}
 	var items []models.ProtocolCredential
 	if err := s.engine.Where("user_id = ? AND enabled = ? AND revoked_at IS NULL", userID, true).Find(&items); err != nil {
 		return nil, fmt.Errorf("load protocol credentials for reveal: %w", err)
@@ -269,7 +272,7 @@ func (s *Service) RevealProtocolCodes(userID int) (map[string]string, error) {
 		if item.CodeCiphertext == "" || item.CodeHash == "" {
 			continue
 		}
-		plain, err := credential.Decrypt(s.vaultRoot, item.CodeCiphertext)
+		plain, err := credential.Decrypt(vaultRoot, item.CodeCiphertext)
 		if err != nil {
 			continue
 		}
diff --git a/frontend/src/views/components/ThirdPartyAuthorization/ThirdPartyAuthorization.js b/frontend/src/views/components/ThirdPartyAuthorization/ThirdPartyAuthorization.js
index 932b073..5c4752a 100644
--- a/frontend/src/views/components/ThirdPartyAuthorization/ThirdPartyAuthorization.js
+++ b/frontend/src/views/components/ThirdPartyAuthorization/ThirdPartyAuthorization.js
@@ -221,7 +221,12 @@ export function usePage() {
       Object.assign(revealedCodes, codes)
       codesRevealed.value = true
       closeVerifyDialog()
-      notify('安全验证通过，授权码已解密显示', 'success')
+      const count = Object.keys(codes).length
+      if (count > 0) {
+        notify(`安全验证通过，已解密显示 ${count} 个协议授权码`, 'success')
+      } else {
+        notify('安全验证通过，当前授权码未保留加密密文，可点击重新生成', 'warning')
+      }
     } catch (error) {
       notify(error?.message || '验证失败，请检查密码是否正确')
     } finally {
diff --git a/frontend/src/views/components/ThirdPartyAuthorization/ThirdPartyAuthorization.vue b/frontend/src/views/components/ThirdPartyAuthorization/ThirdPartyAuthorization.vue
index 0dddc4f..612bbff 100644
--- a/frontend/src/views/components/ThirdPartyAuthorization/ThirdPartyAuthorization.vue
+++ b/frontend/src/views/components/ThirdPartyAuthorization/ThirdPartyAuthorization.vue
@@ -70,6 +70,18 @@
                     复制
                   </el-button>
                 </template>
+                <template v-else-if="codesRevealed && !revealedCodes[item.protocol]">
+                  <span class="unconfigured-tip">旧版授权码未保留密文，请点击重新生成</span>
+                  <el-button
+                    type="primary"
+                    link
+                    size="small"
+                    class="copy-btn"
+                    @click="generateProtocolCode(item)"
+                  >
+                    重新生成
+                  </el-button>
+                </template>
                 <template v-else>
                   <span class="masked-code">••••••••••••••••</span>
                   <el-button