diff --git a/backend/services/auth-service/src/api/controllers/password.controller.ts b/backend/services/auth-service/src/api/controllers/password.controller.ts
index b20367a5..3421ed5b 100644
--- a/backend/services/auth-service/src/api/controllers/password.controller.ts
+++ b/backend/services/auth-service/src/api/controllers/password.controller.ts
@@ -7,6 +7,7 @@ import {
   UseGuards,
 } from '@nestjs/common';
 import { ThrottlerGuard } from '@nestjs/throttler';
+import { IsString, IsNotEmpty, Matches, MinLength } from 'class-validator';
 import { PasswordService } from '@/application/services';
 import { JwtAuthGuard } from '@/shared/guards/jwt-auth.guard';
 import { CapabilityGuard } from '@/shared/guards/capability.guard';
@@ -14,13 +15,30 @@ import { CurrentUser } from '@/shared/decorators/current-user.decorator';
 import { RequireCapability } from '@/shared/decorators/require-capability.decorator';
 
 class ResetPasswordDto {
+  @IsString()
+  @IsNotEmpty()
+  @Matches(/^1[3-9]\d{9}$/, { message: '手机号格式不正确' })
   phone: string;
+
+  @IsString()
+  @IsNotEmpty()
+  @Matches(/^\d{6}$/, { message: '验证码格式不正确' })
   smsCode: string;
+
+  @IsString()
+  @IsNotEmpty()
+  @MinLength(6, { message: '密码至少6位' })
   newPassword: string;
 }
 
 class ChangePasswordDto {
+  @IsString()
+  @IsNotEmpty()
   oldPassword: string;
+
+  @IsString()
+  @IsNotEmpty()
+  @MinLength(6, { message: '密码至少6位' })
   newPassword: string;
 }