diff --git a/backend/server/routers/external_systems/webhook_router.py b/backend/server/routers/external_systems/webhook_router.py
index 56402e26..345c182c 100644
--- a/backend/server/routers/external_systems/webhook_router.py
+++ b/backend/server/routers/external_systems/webhook_router.py
@@ -47,23 +47,12 @@ from yuxi.external_systems.use_cases.dto.webhook import (
     VerifySignatureInput,
 )
 from yuxi.storage.postgres.models_business import User
+from yuxi.utils.crypto import SENSITIVE_HTTP_HEADERS
 
 from server.utils.auth_middleware import get_admin_user, get_db, get_required_user
 
 webhook_router = APIRouter(prefix="/webhooks", tags=["external-systems-webhook"])
 
-# 敏感请求头白名单：``POST /events`` 透传 headers 到 WebhookEvent 持久化前必须剔除，
-# 对齐 ``ExternalWebhookEvent`` ORM 注释"payload/headers 由调用方在写入前完成脱敏"。
-_SENSITIVE_HEADERS = frozenset(
-    {
-        "authorization",
-        "cookie",
-        "set-cookie",
-        "x-api-key",
-        "x-auth-token",
-    }
-)
-
 
 def _extract_client_ip(request: Request) -> str | None:
     """提取客户端真实 IP，优先解析 ``x-forwarded-for``（与访问日志中间件一致）。"""
@@ -76,8 +65,11 @@ def _extract_client_ip(request: Request) -> str | None:
 
 
 def _sanitize_headers(headers: Any) -> dict[str, Any]:
-    """过滤敏感请求头，避免 ``authorization`` / ``cookie`` 等泄露到持久化层。"""
-    return {key: value for key, value in headers.items() if key.lower() not in _SENSITIVE_HEADERS}
+    """过滤敏感请求头，避免 ``authorization`` / ``cookie`` 等泄露到持久化层。
+
+    敏感字段集合统一引用 ``yuxi.utils.crypto.SENSITIVE_HTTP_HEADERS``（单一事实源）。
+    """
+    return {key: value for key, value in headers.items() if key.lower() not in SENSITIVE_HTTP_HEADERS}
 
 
 # ---------------- Request Schemas ----------------