diff --git a/jeecg-module-system/jeecg-system-start/pom.xml b/jeecg-module-system/jeecg-system-start/pom.xml
index b590de8..ef6e8ed 100644
--- a/jeecg-module-system/jeecg-system-start/pom.xml
+++ b/jeecg-module-system/jeecg-system-start/pom.xml
@@ -48,6 +48,12 @@
             <groupId>org.flywaydb</groupId>
             <artifactId>flyway-core</artifactId>
         </dependency>
+
+        <!-- jasypt 配置加密（启动时解密 ENC() 包裹的敏感配置） -->
+        <dependency>
+            <groupId>com.github.ulisesbocchio</groupId>
+            <artifactId>jasypt-spring-boot-starter</artifactId>
+        </dependency>
     </dependencies>
 
     <build>
diff --git a/jeecg-module-system/jeecg-system-start/src/main/resources/application.yml b/jeecg-module-system/jeecg-system-start/src/main/resources/application.yml
index ba9863a..245dc8a 100644
--- a/jeecg-module-system/jeecg-system-start/src/main/resources/application.yml
+++ b/jeecg-module-system/jeecg-system-start/src/main/resources/application.yml
@@ -3,4 +3,14 @@ spring:
     name: jeecg-system
   profiles:
     active: '@profile.name@'
-    include: flow
\ No newline at end of file
+    include: flow
+
+# ============================================
+# 敏感配置加密（jasypt）
+# 口令 JASYPT_ENCRYPTOR_PASSWORD 走环境变量/JVM参数注入，严禁写死明文
+# ============================================
+jasypt:
+  encryptor:
+    password: ${JASYPT_ENCRYPTOR_PASSWORD:}
+    algorithm: PBEWITHHMACSHA512ANDAES_256
+    iv-generator-classname: org.jasypt.iv.RandomIvGenerator
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index 27311de..ce0e4d7 100644
--- a/pom.xml
+++ b/pom.xml
@@ -102,6 +102,9 @@
 
 		<flowable.version>6.8.0</flowable.version>
 
+		<!-- 配置文件敏感信息加密 -->
+		<jasypt.version>3.0.5</jasypt.version>
+
 		<qiniu-uapp-sdk.version>7.4.0</qiniu-uapp-sdk.version>
 
 		<jsoup.version>1.11.3</jsoup.version>
@@ -527,6 +530,12 @@
 				<artifactId>flyway-core</artifactId>
 				<version>7.15.0</version>
 			</dependency>
+			<!-- jasypt 配置加密 -->
+			<dependency>
+				<groupId>com.github.ulisesbocchio</groupId>
+				<artifactId>jasypt-spring-boot-starter</artifactId>
+				<version>${jasypt.version}</version>
+			</dependency>
 		</dependencies>
 	</dependencyManagement>