diff --git a/backend/internal/api/handlers/payment.go b/backend/internal/api/handlers/payment.go
index 6b4543b..8bfd931 100644
--- a/backend/internal/api/handlers/payment.go
+++ b/backend/internal/api/handlers/payment.go
@@ -539,11 +539,6 @@ func (h *PaymentHandler) CreateHashPayPayment(c *gin.Context) {
 
 // HashPayNotify 处理 HashPay 回调通知
 func (h *PaymentHandler) HashPayNotify(c *gin.Context) {
-	// 添加 CORS 头
-	c.Header("Access-Control-Allow-Origin", "*")
-	c.Header("Access-Control-Allow-Methods", "POST, OPTIONS")
-	c.Header("Access-Control-Allow-Headers", "Content-Type")
-
 	body, _ := io.ReadAll(c.Request.Body)
 
 	log.Printf("[HashPay] notify body: %s", string(body))
diff --git a/backend/internal/api/routes/routes.go b/backend/internal/api/routes/routes.go
index 6278f89..5a640a1 100644
--- a/backend/internal/api/routes/routes.go
+++ b/backend/internal/api/routes/routes.go
@@ -33,21 +33,10 @@ func SetupRoutes(r *gin.Engine) {
 
 	r.Static("/uploads", "./uploads")
 	r.Static("/assets", "./static/assets")
+	r.StaticFile("/", "./static/index.html")
 	r.StaticFile("/favicon.svg", "./static/favicon.svg")
 	r.StaticFile("/icons.svg", "./static/icons.svg")
 
-	// HashPay 回调 - 放在 NoRoute 之前，优先匹配
-	r.OPTIONS("/", func(c *gin.Context) {
-		c.Header("Access-Control-Allow-Origin", "*")
-		c.Header("Access-Control-Allow-Methods", "POST, OPTIONS")
-		c.Header("Access-Control-Allow-Headers", "Content-Type")
-		c.String(200, "ok")
-	})
-	r.POST("/", paymentHandler.HashPayNotify)
-
-	r.GET("/", func(c *gin.Context) {
-		c.File("./static/index.html")
-	})
 	r.NoRoute(func(c *gin.Context) {
 		c.File("./static/index.html")
 	})