diff --git a/README.md b/README.md
index 842d380..49b0be7 100644
--- a/README.md
+++ b/README.md
@@ -34,7 +34,7 @@
 - [x] 生成 [RELEASE_REVIEW_REPORT.md](./RELEASE_REVIEW_REPORT.md)
 - [x] 修复 tsconfig 中 dist 类型文件包含规则导致的 `type-check` 失败
 - [x] 校正 README 技术栈版本与 package.json 一致
-- [ ] 生产环境变量与 Nginx 安全头最终确认（上线前）
+- [x] 生产环境变量与 Nginx 安全头最终确认（上线前）
 - [x] CMS 数据模型扩展：为 ContentItem 增加 locale 字段与唯一索引
 - [x] CMS 数据模型扩展：RBAC 角色与权限中间件
 - [x] CMS 内容状态机与工作流：draft/review/published/archived + AuditLog
@@ -72,7 +72,7 @@
   - [x] CMS化 ~75%：所有页面已集成 CMS 数据层、种子脚本覆盖全部内容类型
   - [x] 清理旧版文件：归档 12 个旧版组件至 _archive/（home-content-v11~v13, products-content-v1, product-detail-v1~v2, solutions-content-v1, news-content-v1, team-content-v1~v2, contact-content-v1~v2）
   - [x] 质量门禁通过：type-check ✅ / lint ✅（153 预存 errors） / 992 tests ✅ / coverage 达标 ✅
-  - [x] 待上线前确认：生产环境变量与 Nginx 安全头
+  - [x] 生产环境变量与 Nginx 安全头确认完成：CSP / Permissions-Policy / HSTS 已配置，.env.production 密钥已生成
 
 ## 技术栈
 
diff --git a/next.config.mjs b/next.config.mjs
index 62fd4c5..18104e2 100644
--- a/next.config.mjs
+++ b/next.config.mjs
@@ -28,6 +28,12 @@ const nextConfig = {
           { key: 'X-Content-Type-Options', value: 'nosniff' },
           { key: 'X-Frame-Options', value: 'DENY' },
           { key: 'X-XSS-Protection', value: '1; mode=block' },
+          { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
+          {
+            key: 'Content-Security-Policy',
+            value: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://ssl.google-analytics.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://www.google-analytics.com https://ssl.google-analytics.com; font-src 'self'; connect-src 'self' https://www.google-analytics.com https://ssl.google-analytics.com; frame-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self';",
+          },
+          { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=(), interest-cohort=()' },
         ],
       },
     ];
diff --git a/nginx-static-production.conf b/nginx-static-production.conf
index d61640a..e257f31 100644
--- a/nginx-static-production.conf
+++ b/nginx-static-production.conf
@@ -121,6 +121,8 @@ http {
         add_header X-Content-Type-Options "nosniff" always;
         add_header X-XSS-Protection "1; mode=block" always;
         add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+        add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://ssl.google-analytics.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://www.google-analytics.com https://ssl.google-analytics.com; font-src 'self'; connect-src 'self' https://www.google-analytics.com https://ssl.google-analytics.com; frame-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self';" always;
+        add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), interest-cohort=()" always;
 
         # 静态文件根目录
         root /var/www/novalon;