diff --git a/docs/CASDOOR_SSO_DEPLOYMENT-zh.md b/docs/CASDOOR_SSO_DEPLOYMENT-zh.md
index 5b2dccc..c129bbb 100644
--- a/docs/CASDOOR_SSO_DEPLOYMENT-zh.md
+++ b/docs/CASDOOR_SSO_DEPLOYMENT-zh.md
@@ -95,3 +95,4 @@ bash scripts/casdoor-sso/e2e-check.sh
 | grant-consent `Invalid application` | application 用了裸名 | 用 `admin/DataMate` |
 | authorize 返回 200 不跳转 | 正常（SPA 行为）；若脚本验证用 grant-consent | — |
 | `/sso/casdoor/config` `enabled:false` | `DEEPDATA_CASDOOR_ENABLED` 未注入 | 检查 .env + compose 变量名映射 |
+| `/sso/callback.html` 403（nginx permission denied） | 文件权限 600，nginx worker 非 root 读不到（构建把 600 烤进镜像） | `chmod 644 frontend/public/sso/callback.html` 后重建前端镜像 |