diff --git a/wwwroot/api/work_env.dspy b/wwwroot/api/work_env.dspy
index 364e4fd..c7c504d 100644
--- a/wwwroot/api/work_env.dspy
+++ b/wwwroot/api/work_env.dspy
@@ -8,7 +8,7 @@ if not user_id:
 action = (params_kw or {}).get('action', 'get')
 
 from pipeline_service.work_env import (
-    get_work_env, set_work_env, ensure_remote_bwrap,
+    get_work_env, set_work_env, ensure_remote_bwrap, get_org_pubkey,
 )
 from pipeline_service.deploy_account import account_name_for, sanitize_username
 
@@ -84,5 +84,20 @@ elif action == 'ensure_remote_bwrap':
     except Exception as e:
         return json.dumps({'ok': False, 'error': str(e)}, ensure_ascii=False)
 
+elif action == 'get_org_pubkey':
+    # 获取机构 public key（供 admin 复制到远程主机 authorized_keys）。仅超管。
+    try:
+        async with get_sor_context(request._run_ns, 'pipeline') as _sor:
+            _adm = await _sor.sqlExe(
+                "SELECT 1 FROM userrole WHERE userid=${u}$ AND roleid='owner.superuser' LIMIT 1",
+                {'u': user_id})
+        if not _adm:
+            return json.dumps({'ok': False, 'error': '只有平台管理员能获取机构公钥'}, ensure_ascii=False)
+        _oid = (params_kw or {}).get('org_id', '') or org_id
+        r = get_org_pubkey(_oid)
+        return json.dumps(r, ensure_ascii=False)
+    except Exception as e:
+        return json.dumps({'ok': False, 'error': str(e)}, ensure_ascii=False)
+
 else:
     return json.dumps({'ok': False, 'error': '未知 action: ' + str(action)}, ensure_ascii=False)