diff --git a/Server/src/routes/web.rs b/Server/src/routes/web.rs
index 65b8ee4..d546997 100644
--- a/Server/src/routes/web.rs
+++ b/Server/src/routes/web.rs
@@ -37,14 +37,19 @@ pub fn router(state: AppState) -> Router {
         .allow_methods([Method::GET, Method::POST, Method::DELETE])
         .allow_headers([header::CONTENT_TYPE, header::AUTHORIZATION]);
 
+    // 照片接口接收 base64 上传，需放宽 body 上限到 16MB；其余接口保持
+    // axum 默认 2MB，避免全站放大攻击面。故把照片路由单独成子路由再 merge。
+    let photo_routes = Router::new()
+        .route("/api/web/photos", get(list_photos).post(upload_photo))
+        .route("/api/web/photos/{id}", get(get_photo).delete(delete_photo))
+        .layer(DefaultBodyLimit::max(16 * 1024 * 1024));
+
     Router::new()
         .route("/api/web/stats", get(stats))
         .route("/api/web/gate", post(gate))
         .route("/api/web/login", post(login))
         .route("/api/web/weather", get(weather))
-        .route("/api/web/photos", get(list_photos).post(upload_photo))
-        .route("/api/web/photos/{id}", get(get_photo).delete(delete_photo))
-        .layer(DefaultBodyLimit::max(16 * 1024 * 1024))
+        .merge(photo_routes)
         .layer(cors)
         .with_state(state)
 }