diff --git a/backend/internal/api/handlers/payment.go b/backend/internal/api/handlers/payment.go
index 8bfd931..6b4543b 100644
--- a/backend/internal/api/handlers/payment.go
+++ b/backend/internal/api/handlers/payment.go
@@ -539,6 +539,11 @@ func (h *PaymentHandler) CreateHashPayPayment(c *gin.Context) {
 
 // HashPayNotify 处理 HashPay 回调通知
 func (h *PaymentHandler) HashPayNotify(c *gin.Context) {
+	// 添加 CORS 头
+	c.Header("Access-Control-Allow-Origin", "*")
+	c.Header("Access-Control-Allow-Methods", "POST, OPTIONS")
+	c.Header("Access-Control-Allow-Headers", "Content-Type")
+
 	body, _ := io.ReadAll(c.Request.Body)
 
 	log.Printf("[HashPay] notify body: %s", string(body))
diff --git a/backend/internal/api/routes/routes.go b/backend/internal/api/routes/routes.go
index 5a640a1..6278f89 100644
--- a/backend/internal/api/routes/routes.go
+++ b/backend/internal/api/routes/routes.go
@@ -33,10 +33,21 @@ func SetupRoutes(r *gin.Engine) {
 
 	r.Static("/uploads", "./uploads")
 	r.Static("/assets", "./static/assets")
-	r.StaticFile("/", "./static/index.html")
 	r.StaticFile("/favicon.svg", "./static/favicon.svg")
 	r.StaticFile("/icons.svg", "./static/icons.svg")
 
+	// HashPay 回调 - 放在 NoRoute 之前，优先匹配
+	r.OPTIONS("/", func(c *gin.Context) {
+		c.Header("Access-Control-Allow-Origin", "*")
+		c.Header("Access-Control-Allow-Methods", "POST, OPTIONS")
+		c.Header("Access-Control-Allow-Headers", "Content-Type")
+		c.String(200, "ok")
+	})
+	r.POST("/", paymentHandler.HashPayNotify)
+
+	r.GET("/", func(c *gin.Context) {
+		c.File("./static/index.html")
+	})
 	r.NoRoute(func(c *gin.Context) {
 		c.File("./static/index.html")
 	})