diff --git a/pom.xml b/pom.xml
index 7404439236..3c090230fb 100644
--- a/pom.xml
+++ b/pom.xml
@@ -40,6 +40,7 @@
         <maven.compiler.target>${java.version}</maven.compiler.target>
         <maven-surefire-plugin.version>3.5.3</maven-surefire-plugin.version>
         <maven-compiler-plugin.version>3.14.0</maven-compiler-plugin.version>
+        <maven-enforcer-plugin.version>3.5.0</maven-enforcer-plugin.version>
         <flatten-maven-plugin.version>1.7.2</flatten-maven-plugin.version>
         <!-- maven-surefire-plugin 暂时无法通过 bom 的依赖读取（兼容老版本 IDEA 2024 及以前版本） -->
         <lombok.version>1.18.38</lombok.version>
@@ -112,6 +113,11 @@
                     <groupId>org.codehaus.mojo</groupId>
                     <artifactId>flatten-maven-plugin</artifactId>
                 </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-enforcer-plugin</artifactId>
+                    <version>${maven-enforcer-plugin.version}</version>
+                </plugin>
             </plugins>
         </pluginManagement>
 
diff --git a/yudao-module-ai/pom.xml b/yudao-module-ai/pom.xml
index 4f545f9a1a..86c5c63c7a 100644
--- a/yudao-module-ai/pom.xml
+++ b/yudao-module-ai/pom.xml
@@ -247,6 +247,15 @@
                     <artifactId>spring-cloud-function-core</artifactId>
                     <groupId>org.springframework.cloud</groupId>
                 </exclusion>
+                <!-- 排除 BouncyCastle，避免 Spring Boot 嵌套 JAR 导致 JCE 签名校验失败 -->
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcprov-jdk18on</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcpkix-jdk18on</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
 
diff --git a/yudao-module-tik/pom.xml b/yudao-module-tik/pom.xml
index 18f52c28a2..366a898c0d 100644
--- a/yudao-module-tik/pom.xml
+++ b/yudao-module-tik/pom.xml
@@ -271,6 +271,15 @@
                     <artifactId>spring-cloud-function-core</artifactId>
                     <groupId>org.springframework.cloud</groupId>
                 </exclusion>
+                <!-- 排除 BouncyCastle，避免 Spring Boot 嵌套 JAR 导致 JCE 签名校验失败 -->
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcprov-jdk18on</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcpkix-jdk18on</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
 
diff --git a/yudao-server/pom.xml b/yudao-server/pom.xml
index 8f825bd6bc..28b6eaf00e 100644
--- a/yudao-server/pom.xml
+++ b/yudao-server/pom.xml
@@ -153,6 +153,38 @@
                     </execution>
                 </executions>
             </plugin>
+            <!-- 防止 BouncyCastle 签名 JAR 进入 fat JAR，导致 JCE 验证失败 -->
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-enforcer-plugin</artifactId>
+                <version>${maven-enforcer-plugin.version}</version>
+                <executions>
+                    <execution>
+                        <id>ban-bouncycastle</id>
+                        <goals>
+                            <goal>enforce</goal>
+                        </goals>
+                        <phase>package</phase>
+                        <configuration>
+                            <rules>
+                                <bannedDependencies>
+                                    <excludes>
+                                        <exclude>org.bouncycastle:bcprov-jdk18on</exclude>
+                                        <exclude>org.bouncycastle:bcpkix-jdk18on</exclude>
+                                        <exclude>org.bouncycastle:bcprov-jdk15on</exclude>
+                                        <exclude>org.bouncycastle:bcpkix-jdk15on</exclude>
+                                    </excludes>
+                                    <message>
+                                        BouncyCastle JAR 是签名的，在 Spring Boot fat JAR 中会导致 JCE 签名验证失败。
+                                        请在对应依赖中添加 exclusion 排除 org.bouncycastle。
+                                    </message>
+                                </bannedDependencies>
+                            </rules>
+                            <fail>true</fail>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
         </plugins>
     </build>