diff --git a/backend/.env.example b/backend/.env.example
index 37349cb..d2a3cf1 100644
--- a/backend/.env.example
+++ b/backend/.env.example
@@ -49,8 +49,8 @@ T_PLUS_ODBC_DRIVER=
 # 默认启用传输加密。旧实例 TLS 不兼容时，仅隔离开发环境可显式设为 false，
 # 记录原因并重新验收；程序不会自动降级。真实环境值后续按验收结果填写。
 T_PLUS_ENCRYPT=true
-# 内网自签证书可暂用 true；它不校验证书身份。部署可信证书后改为 false。
-T_PLUS_TRUST_SERVER_CERTIFICATE=true
+# 默认校验服务器证书。仅隔离开发环境可显式设为 true，并记录原因和验收范围。
+T_PLUS_TRUST_SERVER_CERTIFICATE=false
 T_PLUS_CONNECT_TIMEOUT=10
 T_PLUS_QUERY_TIMEOUT=120
 # 可选：留空时使用仓库根目录下的 db/queries/tplus/
diff --git a/backend/app/core/config.py b/backend/app/core/config.py
index 70232be..9c63420 100644
--- a/backend/app/core/config.py
+++ b/backend/app/core/config.py
@@ -92,7 +92,8 @@ class Settings(BaseSettings):
     # 部署前必须指定已在 SQL Server 2008 R2 实测的驱动，不自动选择最新版。
     t_plus_odbc_driver: str = ""
     t_plus_encrypt: bool = True
-    t_plus_trust_server_certificate: bool = True
+    # 默认校验服务器证书；自签回退只允许隔离开发显式开启，避免中间人替换证书。
+    t_plus_trust_server_certificate: bool = False
     t_plus_connect_timeout: int = 10
     t_plus_query_timeout: int = Field(default=120, ge=1, le=600)
     t_plus_query_dir: str = ""
diff --git a/backend/tests/unit/test_tplus_config.py b/backend/tests/unit/test_tplus_config.py
index 1a565c3..f1a0b67 100644
--- a/backend/tests/unit/test_tplus_config.py
+++ b/backend/tests/unit/test_tplus_config.py
@@ -34,14 +34,14 @@ def test_T加未启用时读取器不建立连接() -> None:
     assert settings.t_plus_enabled is False
 
 
-def test_T加默认加密且允许显式隔离环境回退(monkeypatch) -> None:
+def test_T加默认加密并默认校验服务器证书(monkeypatch) -> None:
     monkeypatch.delenv("T_PLUS_ENCRYPT", raising=False)
     monkeypatch.delenv("T_PLUS_TRUST_SERVER_CERTIFICATE", raising=False)
     assert _settings().t_plus_database_url.query["Encrypt"] == "yes"
-    assert _settings().t_plus_database_url.query["TrustServerCertificate"] == "yes"
-    url = _settings(t_plus_encrypt=False, t_plus_trust_server_certificate=False).t_plus_database_url
+    assert _settings().t_plus_database_url.query["TrustServerCertificate"] == "no"
+    url = _settings(t_plus_encrypt=False, t_plus_trust_server_certificate=True).t_plus_database_url
     assert url.query["Encrypt"] == "no"
-    assert url.query["TrustServerCertificate"] == "no"
+    assert url.query["TrustServerCertificate"] == "yes"
 
 
 @pytest.mark.parametrize("value", ["a;b", "a}b", "{prefix", "中文;UID=other}x"])
diff --git a/docker/docker-compose.dev.yml b/docker/docker-compose.dev.yml
index 3c242ec..b301e3b 100644
--- a/docker/docker-compose.dev.yml
+++ b/docker/docker-compose.dev.yml
@@ -24,7 +24,7 @@ services:
       # 首次启动自动执行 db/init 下的初始化脚本
       - ../db/init:/docker-entrypoint-initdb.d
     ports:
-      - "3306:3306"
+      - "127.0.0.1:3306:3306"
     healthcheck:
       test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-uroot", "-p${MYSQL_ROOT_PASSWORD}"]
       interval: 10s
@@ -45,7 +45,7 @@ services:
     volumes:
       - redis-dev-data:/data
     ports:
-      - "6379:6379"
+      - "127.0.0.1:6379:6379"
     healthcheck:
       test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "--no-auth-warning", "ping"]
       interval: 10s