diff --git a/scripts/sync-uploads-to-minio.ps1 b/scripts/sync-uploads-to-minio.ps1
new file mode 100644
index 00000000..a4a2f167
--- /dev/null
+++ b/scripts/sync-uploads-to-minio.ps1
@@ -0,0 +1,56 @@
+# Sync repo-root uploads/ -> MinIO bucket prefix uploads/ (matches DB paths /uploads/...)
+# Requires MinIO Client: https://min.io/docs/minio/linux/reference/minio-mc.html
+# Run from repo root:
+#   .\scripts\sync-uploads-to-minio.ps1 -McPath "D:\tools\mc.exe"
+# Optional params: -Endpoint -User -Password -Bucket -Alias
+
+param(
+    [string] $Endpoint = "http://117.72.159.31:9000",
+    [string] $User = "minioadmin",
+    [string] $Password = "minioadmin",
+    [string] $Bucket = "wuhan-saga",
+    [string] $Alias = "wuhan-saga-remote",
+    [string] $McPath = ""
+)
+
+$ErrorActionPreference = "Stop"
+[Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false)
+
+$root = Split-Path -Parent $PSScriptRoot
+if (-not (Test-Path -LiteralPath $root)) { $root = (Get-Location).Path }
+
+$uploads = Join-Path $root "uploads"
+if (-not (Test-Path -LiteralPath $uploads)) {
+    Write-Host "Skip: no folder $uploads"
+    exit 0
+}
+
+$mcExe = $McPath
+if (-not [string]::IsNullOrWhiteSpace($mcExe)) {
+    if (-not (Test-Path -LiteralPath $mcExe)) {
+        throw "McPath not found: $mcExe"
+    }
+}
+else {
+    $tryLocal = Join-Path $root ".tools\mc.exe"
+    if (Test-Path -LiteralPath $tryLocal) { $mcExe = $tryLocal }
+}
+if ([string]::IsNullOrWhiteSpace($mcExe)) {
+    $mcCmd = Get-Command mc -ErrorAction SilentlyContinue
+    if ($mcCmd) { $mcExe = $mcCmd.Source }
+}
+if ([string]::IsNullOrWhiteSpace($mcExe)) {
+    throw "mc not found. Add to PATH, or place .tools/mc.exe, or pass -McPath. Download: https://dl.min.io/client/mc/release/windows-amd64/mc.exe"
+}
+
+Write-Host "Using mc: $mcExe"
+& $mcExe alias set $Alias $Endpoint $User $Password
+if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+& $mcExe mb "$Alias/$Bucket" --ignore-existing 2>$null
+
+Write-Host "Mirror: $uploads -> $Alias/$Bucket/uploads/"
+& $mcExe mirror --overwrite $uploads "$Alias/$Bucket/uploads"
+if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+Write-Host "Done. Check bucket $Bucket for uploads/banner etc."
diff --git a/server/deploy/minio-spring-config.example.yml b/server/deploy/minio-spring-config.example.yml
index b9fe01de..4af4d943 100644
--- a/server/deploy/minio-spring-config.example.yml
+++ b/server/deploy/minio-spring-config.example.yml
@@ -1,4 +1,4 @@
-# Spring Boot 使用 MinIO 时，在「生产配置」里增加或改成以下内容。
+  # Spring Boot 使用 MinIO 时，在「生产配置」里增加或改成以下内容。
 # 不要提交含真实生产密码的副本；交给运维时可另存为服务器上的 application-prod.yml。
 #
 # 启动示例：java -jar wuhan-saga-server.jar --spring.profiles.active=prod
@@ -21,7 +21,7 @@ upload:
 
 minio:
   endpoint: http://127.0.0.1:9000
-  access-key: klp
-  secret-key: ruoyi123
+  access-key: minioadmin
+  secret-key: minioadmin
   bucket: wuhan-saga
   region: us-east-1
diff --git a/server/src/main/resources/application.yml b/server/src/main/resources/application.yml
index be64af1e..e6b5ef3b 100644
--- a/server/src/main/resources/application.yml
+++ b/server/src/main/resources/application.yml
@@ -56,18 +56,18 @@ knife4j:
   setting:
     language: zh_cn
 
-# 存储：local=本机 uploads | minio=对象存储，见 server/deploy/minio-spring-config.example.yml
+# 存储：local=本机 uploads | minio=对象存储（9000 为 API，不是控制台 9001）
+# 密钥可用环境变量覆盖：MINIO_ACCESS_KEY、MINIO_SECRET_KEY（勿将生产密码提交到公开仓库）
 upload:
-  storage: local
+  storage: minio
   path: uploads/
   allowed-types: image/jpeg,image/png,image/gif,image/webp,image/svg+xml,video/mp4,video/webm
   max-size: 52428800
 
-# 仅 upload.storage=minio 时生效；密钥用环境变量注入，勿提交生产明文
 minio:
-  endpoint: http://127.0.0.1:9000
-  access-key: minioadmin
-  secret-key: minioadmin
+  endpoint: http://117.72.159.31:9000
+  access-key: ${MINIO_ACCESS_KEY:minioadmin}
+  secret-key: ${MINIO_SECRET_KEY:minioadmin}
   bucket: wuhan-saga
   region: us-east-1