diff --git a/docs/changelog/2026-06-21-btpanel-api-json-path-fix.md b/docs/changelog/2026-06-21-btpanel-api-json-path-fix.md
index 8780618f..08540e97 100644
--- a/docs/changelog/2026-06-21-btpanel-api-json-path-fix.md
+++ b/docs/changelog/2026-06-21-btpanel-api-json-path-fix.md
@@ -10,7 +10,8 @@ SSH bootstrap 将 API 配置写入 `/www/server/panel/data/api.json`，而宝塔
 
 ## 涉及文件
 
-- `server/infrastructure/btpanel/ssh_bootstrap.py` — `API_PATH` 改为 `panel/config/api.json`
+- `server/infrastructure/btpanel/client.py` — 签名 `md5(time+token)`
+- `server/infrastructure/btpanel/ssh_bootstrap.py` — `base_url` 不含安全入口路径
 - `tests/test_btpanel_ssh_bootstrap.py` — `exit_code=0` 回归用例（上一轮）
 
 ## 迁移 / 重启
diff --git a/server/application/services/btpanel_service.py b/server/application/services/btpanel_service.py
index 2ed1016d..27a6df4d 100644
--- a/server/application/services/btpanel_service.py
+++ b/server/application/services/btpanel_service.py
@@ -12,7 +12,6 @@ from server.domain.models import AuditLog, Server
 from server.infrastructure.btpanel.client import BtPanelApiError, BtPanelClient
 from server.infrastructure.btpanel.credentials import (
     BtPanelCredentials,
-    get_bt_panel_base_url,
     merge_bt_panel_extra,
     public_bt_panel_status,
     read_bt_panel_credentials,
@@ -406,8 +405,7 @@ class BtPanelService:
 
         if not url:
             method = "ssh"
-            panel_base = (creds.base_url if creds else None) or get_bt_panel_base_url(server)
-            url = await ssh_temp_login_url(server, base_url=panel_base)
+            url = await ssh_temp_login_url(server, base_url=None)
 
         await self.audit.create(AuditLog(
             admin_username=admin_username,
diff --git a/server/infrastructure/btpanel/ssh_bootstrap.py b/server/infrastructure/btpanel/ssh_bootstrap.py
index 9ec203ab..6afcee71 100644
--- a/server/infrastructure/btpanel/ssh_bootstrap.py
+++ b/server/infrastructure/btpanel/ssh_bootstrap.py
@@ -51,8 +51,7 @@ def main():
     scheme = "https" if ssl else "http"
     host = panel_host or "127.0.0.1"
     base = f"{scheme}://{host}:{port}"
-    if admin_path and admin_path != "/":
-        base += "/" + admin_path.strip("/")
+    # API 根路径不含安全入口；浏览器登录 URL 由 ssh_login 单独探测 admin_path
     api = {}
     if os.path.isfile(API_PATH):
         try: