diff --git a/internal/core/channels_loomy_test.go b/internal/core/channels_loomy_test.go
index d743b9a..f218e06 100644
--- a/internal/core/channels_loomy_test.go
+++ b/internal/core/channels_loomy_test.go
@@ -33,7 +33,10 @@ func newLoomyHarness(t *testing.T) *loomyHarness {
 		switch {
 		case strings.HasPrefix(r.URL.Path, "/connect/qrconnect"):
 			w.Header().Set("Content-Type", "text/html")
-			fmt.Fprint(w, `<html><script>var uuid = "UUID-TEST-1";</script></html>`)
+			// 夹具必须用**真实微信页面的形态**：uuid 内嵌在
+			// <img class="js_qrcode_img" src="/connect/qrcode/<uuid>"/>。
+			// 用别的形态（如 var uuid = "..."）测出来的正则不是生产要用的那条。
+			fmt.Fprint(w, `<html><img class="js_qrcode_img" src="/connect/qrcode/UUID-TEST-1"/></html>`)
 		case strings.HasPrefix(r.URL.Path, "/connect/l/qrconnect"):
 			n := atomic.AddInt32(&h.polls, 1)
 			w.Header().Set("Content-Type", "text/plain")
@@ -159,7 +162,7 @@ func TestLoomyWechatPollBehavior(t *testing.T) {
 			hh := newLoomyHarness(t)
 			hh.ts.Config.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 				if strings.HasPrefix(r.URL.Path, "/connect/qrconnect") {
-					fmt.Fprint(w, `<script>var uuid = "U";</script>`)
+					fmt.Fprint(w, `<img src="/connect/qrcode/U">`)
 					return
 				}
 				fmt.Fprintf(w, "window.wx_errcode=%s;", tc.errcode)
diff --git a/internal/lua/plugins/channels.lua b/internal/lua/plugins/channels.lua
index 15bd1e9..55a47ed 100644
--- a/internal/lua/plugins/channels.lua
+++ b/internal/lua/plugins/channels.lua
@@ -575,13 +575,17 @@ local PLATFORMS = {
     --   403=用户取消；402=二维码失效
     flow = "wechat-poll",
     wechat = {
+      -- appid / redirect_uri 照参考常量（原写的 appid 是我编的，上游不认）；
+      -- 末尾 `#wechat_redirect` 是微信要求的固定片段，缺它对某些客户端会跳错页。
       auth_url = "https://open.weixin.qq.com/connect/qrconnect"
-        .. "?appid=wx16e5c2b8e0c0e1f2&scope=snsapi_login&response_type=code"
-        .. "&redirect_uri=https%3A%2F%2Floomy.xunfei.cn%2Foauth%2Fwechat%2Fcallback&state={state}",
+        .. "?appid=wx18d60be432287cf8&scope=snsapi_login&response_type=code"
+        .. "&redirect_uri=https%3A%2F%2Floomy.xunfei.cn%2Foauth%2Fwechat%2Fcallback"
+        .. "&state={state}#wechat_redirect",
       qr_url = "https://open.weixin.qq.com/connect/qrcode/{uuid}",
       poll_url = "https://long.open.weixin.qq.com/connect/l/qrconnect",
+      -- 逐字照参考 WECHAT_UA（微信对空 UA / 爬虫 UA 可能拒绝）
       user_agent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
-        .. " (KHTML, like Gecko) Chrome/120.0 Safari/537.36",
+        .. " (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
       account_base = "https://account.xfyun.cn",
       bind_path = "/login/thirdAccount/bind/auth",
       access_key_id = "2thryby66wxi53sk",
@@ -2157,10 +2161,12 @@ function plugin.start_login(req)
       return { status = 200, json = out }
     end
     local html = resp.body or ""
-    -- 主正则 + 兜底（含 uuid 的查询串）
-    local uuid = html:match('uuid%s*=%s*"([^"]+)"')
-      or html:match("uuid%s*=%s*'([^']+)'")
-      or html:match("[?&]uuid=([%w%-_]+)")
+    -- 两条路径互为兜底（照参考 extractLoomyWechatUuid 的正则）：
+    --   主：<img class="js_qrcode_img" src="/connect/qrcode/<uuid>"/>
+    --   兜底：var fordevtool = "…/connect/l/qrconnect?uuid=<uuid>"
+    -- ⚠️ 无需执行 JS —— 这是本方案能脱离浏览器的基础。
+    local uuid = html:match("/connect/qrcode/([%w_%-=+/]+)")
+      or html:match("l/qrconnect%?uuid=([%w_%-=+/]+)")
     if not uuid or uuid == "" then
       sess.state = "failed"
       out.error = "微信授权页未包含二维码 uuid（页面结构可能已变化）"