diff --git a/middleware.ts b/middleware.ts
deleted file mode 100644
index f227e2f41..000000000
--- a/middleware.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-
-/**
- * Middleware to ensure payment callback paths are never blocked by auth.
- *
- * DuluPay sends server-to-server GET/POST callbacks without any session
- * cookie.  Without this middleware, the request may be intercepted and
- * redirected to the login page (HTTP 307), causing payment notifications
- * to fail silently and points never being credited.
- */
-export function middleware(_request: NextRequest) {
-  return NextResponse.next();
-}
-
-export const config = {
-  matcher: ["/api/payment/:path*"],
-};
diff --git a/proxy.ts b/proxy.ts
index c4c9a0c58..8a58b3d2d 100644
--- a/proxy.ts
+++ b/proxy.ts
@@ -161,6 +161,11 @@ export async function proxy(request: NextRequest) {
     return NextResponse.next();
   }
 
+  // 允许 DuluPay 支付回调（服务端回调无 session cookie）
+  if (pathname.startsWith("/api/payment/")) {
+    return NextResponse.next();
+  }
+
   // 检测是否为 HTTPS（通过 AUTH_URL 或请求协议判断）
   const isSecure = process.env.AUTH_URL?.startsWith("https://") || 
                    request.nextUrl.protocol === "https:";