diff --git a/Dockerfile b/Dockerfile
index 702b9e6..7497b26 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -42,6 +42,11 @@ ENV KAFKA_VERSION=2.4.0.0
 ENV KAFKA_USERNAME=
 ENV KAFKA_PASSWORD=
 ENV KAFKA_SASL_MECHANISM=SCRAM-SHA-512
+ENV IM_ADMIN_API_BASE_URL=http://im-server:6060
+ENV IM_ADMIN_API_SECRET=
+ENV IM_INTERNAL_API_BASE_URL=http://im-server:6060
+ENV IM_INTERNAL_API_SECRET=
+ENV IM_CONFIG_API_SECRET=
 
 COPY --from=server-build /src/manifest ./manifest
 COPY --from=server-build /src/hack ./hack
diff --git a/server/internal/library/imadmin/client.go b/server/internal/library/imadmin/client.go
index 7b99cb3..032c68c 100644
--- a/server/internal/library/imadmin/client.go
+++ b/server/internal/library/imadmin/client.go
@@ -17,6 +17,7 @@ import (
 	"time"
 
 	"github.com/gogf/gf/v2/errors/gerror"
+	"github.com/gogf/gf/v2/frame/g"
 	"github.com/gogf/gf/v2/os/gctx"
 )
 
@@ -198,6 +199,9 @@ func (c *Client) parseError(resp *http.Response) error {
 		Reason  string `json:"reason"`
 	}
 	_ = json.Unmarshal(body, &envelope)
+	if envelope.Message == "" && envelope.Reason == "" {
+		g.Log().Warningf(context.Background(), "IM API returned non-success status:%d url:%s body:%s", resp.StatusCode, resp.Request.URL.String(), string(body))
+	}
 	return stableError(envelope.Message, envelope.Reason)
 }
 
diff --git a/server/manifest/config/config.template b/server/manifest/config/config.template
index c28a55a..2afb12b 100644
--- a/server/manifest/config/config.template
+++ b/server/manifest/config/config.template
@@ -306,17 +306,17 @@ hggen:
     webViewsPath: "../web/src/views/addons/{$name}"                 # web页面生成路径
 
 imAdminApi:
-  baseUrl: "http://im-server:6060"
+  baseUrl: "$IM_ADMIN_API_BASE_URL"
   serviceId: "hotgo-admin"
-  serviceSecret: "8569f5626a54950539eece9f731c9e3bf073daa74af8d23735d19afacac40f4b"
+  serviceSecret: "$IM_ADMIN_API_SECRET"
   timeout: "5s"
 
 imInternalApi:
-  baseUrl: "http://im-server:6060/v1"
+  baseUrl: "$IM_INTERNAL_API_BASE_URL"
   serviceName: "hotgo-admin"
-  serviceSecret: "8569f5626a54950539eece9f731c9e3bf073daa74af8d23735d19afacac40f4b"
+  serviceSecret: "$IM_INTERNAL_API_SECRET"
 
 imConfigApi:
   serviceName: "im-server"
-  serviceSecret: "b96832c04dbfb6dd768930ec9f082ecd90d87a1ffdaa493aa070617c48de9097"
+  serviceSecret: "$IM_CONFIG_API_SECRET"
   timeWindow: "300s"
diff --git a/server/manifest/docker/entrypoint.sh b/server/manifest/docker/entrypoint.sh
index 608a9fe..d5e6abc 100644
--- a/server/manifest/docker/entrypoint.sh
+++ b/server/manifest/docker/entrypoint.sh
@@ -6,7 +6,7 @@ cd /app
 # Render the real config from the template using only the specific env vars we
 # expect — avoids accidentally substituting anything else that might contain a
 # literal '$' in the YAML.
-envsubst '$MYSQL_DSN $REDIS_ADDR $REDIS_DB $REDIS_PASSWORD $TOKEN_SECRET_KEY $QUEUE_DRIVER $KAFKA_ADDRESS $KAFKA_VERSION $KAFKA_USERNAME $KAFKA_PASSWORD $KAFKA_SASL_MECHANISM' \
+envsubst '$MYSQL_DSN $REDIS_ADDR $REDIS_DB $REDIS_PASSWORD $TOKEN_SECRET_KEY $QUEUE_DRIVER $KAFKA_ADDRESS $KAFKA_VERSION $KAFKA_USERNAME $KAFKA_PASSWORD $KAFKA_SASL_MECHANISM $IM_ADMIN_API_BASE_URL $IM_ADMIN_API_SECRET $IM_INTERNAL_API_BASE_URL $IM_INTERNAL_API_SECRET $IM_CONFIG_API_SECRET' \
   < manifest/config/config.template > manifest/config/config.yaml
 
 exec ./hotgo