diff --git a/server/manifest/config/config.example.yaml b/server/manifest/config/config.example.yaml
index 2fcbb9e..14e5525 100644
--- a/server/manifest/config/config.example.yaml
+++ b/server/manifest/config/config.example.yaml
@@ -322,7 +322,7 @@ imInternalApi:
 imWorkbenchApi:
   baseUrl: "http://im_workbench:6061"
   serviceName: "hotgo-admin"
-  serviceSecret: "${IM_WORKBENCH_API_SECRET}"
+  serviceSecret: "${IM_INTERNAL_API_SECRET}"
   timeout: "5s"
 
 imConfigApi:
diff --git a/server/manifest/docker/entrypoint.sh b/server/manifest/docker/entrypoint.sh
index 619ded8..666039e 100644
--- a/server/manifest/docker/entrypoint.sh
+++ b/server/manifest/docker/entrypoint.sh
@@ -3,6 +3,14 @@ set -e
 
 cd /app
 
+if [ -z "${IM_WORKBENCH_API_SECRET:-}" ]; then
+  if [ -n "${IM_INTERNAL_API_SECRET:-}" ]; then
+    export IM_WORKBENCH_API_SECRET="$IM_INTERNAL_API_SECRET"
+  elif [ -n "${IM_ADMIN_API_SECRET:-}" ]; then
+    export IM_WORKBENCH_API_SECRET="$IM_ADMIN_API_SECRET"
+  fi
+fi
+
 # Render the real config from the template using only the specific env vars we
 # expect — avoids accidentally substituting anything else that might contain a
 # literal '$' in the YAML.