diff --git a/pipeline_service/secret_vault.py b/pipeline_service/secret_vault.py
index 26faf77..dacbfca 100644
--- a/pipeline_service/secret_vault.py
+++ b/pipeline_service/secret_vault.py
@@ -604,6 +604,28 @@ async def delete_secret(sor, *, name: str = "", secret_id: str = "",
     return {"ok": True, "message": "已删除 " + row.get("name", "")}
 
 
+async def update_secret_meta(sor, *, name: str, label: str = "", remark: str = "",
+                             org_id: str = "", user_id: str = "", who: str = "") -> Dict:
+    """改标签/备注（**仅本人条目**；值不可改——改值走删除重存，避免指纹/审计歧义）。
+
+    管理页（2026-09-18）用；与 set_secret_status 同款 own_only + _assert_own 双防线。
+    """
+    from .audit import record_audit
+    row = await get_secret_row(sor, name=name, org_id=org_id, user_id=user_id,
+                               own_only=True)
+    if not row or not _assert_own(row, user_id):
+        return {"ok": False, "message": "FAIL: 找不到该敏感信息（或不属于你本人）"}
+    await sor.sqlExe(
+        "UPDATE " + TABLE + " SET label=${l}$, remark=${r}$, updated_at=NOW() WHERE id=${i}$",
+        {"l": label or "", "r": remark or "", "i": row["id"]})
+    try:
+        await record_audit(org_id or user_id or "", TABLE, row["id"], "secret_meta_update",
+                           who=who or user_id or "agent", detail="name=" + name)
+    except Exception:
+        pass
+    return {"ok": True, "message": name + " 元数据已更新"}
+
+
 async def set_secret_status(sor, *, name: str, status: str, org_id: str = "",
                             user_id: str = "", who: str = "") -> Dict:
     """启用/停用（active / disabled）。停用后不再注入执行环境。"""