diff --git a/wwwroot/api/admin_reset_password.dspy b/wwwroot/api/admin_reset_password.dspy
index 4707401..f1be15e 100644
--- a/wwwroot/api/admin_reset_password.dspy
+++ b/wwwroot/api/admin_reset_password.dspy
@@ -17,6 +17,11 @@ target_id = ns.get('userid')
 new_password = ns.get('new_password')
 cfm_password = ns.get('cfm_password')
 
+# 守卫：管理员不得重置自己的密码（自己改密走 /rbac/user/reset_password 自助入口）
+op_id = await get_user()
+if op_id and str(op_id) == str(target_id):
+	return {"widgettype":"Error","options":{"title":"Reset Password Error","cwidth":16,"cheight":9,"timeout":3,"message":"cannot reset your own password, use self-service reset"}}
+
 if not target_id:
 	return {"widgettype":"Error","options":{"title":"Parameter Error","cwidth":16,"cheight":9,"timeout":3,"message":"missing userid"}}
 if not new_password or len(new_password) < 8: