diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 3673d99..0aa111a 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -45,6 +45,7 @@ services:
       - WX_SECRET=${WX_SECRET:-}
       - WX_PAY_MCH_ID=${WX_PAY_MCH_ID:-}
       - WX_PAY_SERIAL_NO=${WX_PAY_SERIAL_NO:-}
+      - WX_PAY_MCH_CERT_SERIAL=${WX_PAY_MCH_CERT_SERIAL:-}
       - WX_PAY_API_KEY=${WX_PAY_API_KEY:-}
       - WX_PAY_NOTIFY_URL=${WX_PAY_NOTIFY_URL:-}
       - ADMIN_USERNAME=${ADMIN_USERNAME:-admin}
diff --git a/server/src/utils/weixin.js b/server/src/utils/weixin.js
index 9492269..ac36647 100755
--- a/server/src/utils/weixin.js
+++ b/server/src/utils/weixin.js
@@ -46,7 +46,9 @@ class WeChatService {
     signer.update(message)
     signer.end()
     const signature = signer.sign(this.privateKey, 'base64')
-    return `WECHATPAY2-SHA256-RFC4648 mchid="${this.mchId}",nonce_str="${nonce}",signature="${signature}",timestamp="${timestamp}",serial_no="${this.serialNo}"`
+    // 请求头 serial_no 用商户证书序列号；WX_PAY_SERIAL_NO（PUB_KEY_ID_ 开头）是微信支付公钥ID，仅用于验签微信应答
+    const requestSerial = process.env.WX_PAY_MCH_CERT_SERIAL || this.serialNo
+    return `WECHATPAY2-SHA256-RFC4648 mchid="${this.mchId}",nonce_str="${nonce}",signature="${signature}",timestamp="${timestamp}",serial_no="${requestSerial}"`
   }
   
   /**