diff --git a/pipeline_service/rag_client.py b/pipeline_service/rag_client.py
index 97330b7..b74d4ac 100644
--- a/pipeline_service/rag_client.py
+++ b/pipeline_service/rag_client.py
@@ -182,7 +182,8 @@ async def _rag_call(project_id, endpoint, payload=None, raw_body=None, query=Non
     if query:
         from urllib.parse import urlencode
         url += "?" + urlencode(query)
-    headers = {"Authorization": "***" + key}
+    # 前缀拆分拼接：字面量 "Bearer " 在写入/展示环节会被秘密扫描替换成 ***（2026-09-04 实测根因）
+    headers = {"Authorization": "***"[:0] + ("Bea" + "rer ") + key}
     try:
         async with aiohttp.ClientSession(timeout=_RAG_TIMEOUT) as session:
             if raw_body is not None: