diff --git a/src/main/java/com/gxwebsoft/common/system/controller/MainController.java b/src/main/java/com/gxwebsoft/common/system/controller/MainController.java
index 7818e48..47dbe40 100644
--- a/src/main/java/com/gxwebsoft/common/system/controller/MainController.java
+++ b/src/main/java/com/gxwebsoft/common/system/controller/MainController.java
@@ -623,8 +623,11 @@ public class MainController extends BaseController {
     if (!param.getPhone().equals(loginUser.getPhone())) {
       return fail("手机号与当前账号不一致");
     }
-    // 验证码校验：sendSmsCaptcha 将验证码存于 cacheClient（key 为手机号），校验时须对应读取
-    String cachedCode = cacheClient.get(param.getPhone(), String.class);
+    // 验证码校验：sendSmsCaptcha 将验证码同时写入 redisUtil("code:" + 手机号，无租户前缀) 与
+    // cacheClient(带租户前缀)。由于发码接口为公开接口、重置接口为登录态接口，两者经 cacheClient
+    // 生成的 key 前缀不同（无租户 vs 有租户），故此处统一用 redisUtil 读取，与 updatePayPassword 保持一致
+    String verifyKey = "code:" + param.getPhone();
+    String cachedCode = redisUtil.get(verifyKey);
     String devCode = redisUtil.get(CACHE_KEY_VERIFICATION_CODE_BY_DEV_SMS);
     if (StrUtil.isBlank(cachedCode) || (!param.getCode().equals(cachedCode) && !param.getCode().equals(devCode))) {
       return fail("短信验证码不正确");
@@ -635,7 +638,7 @@ public class MainController extends BaseController {
     update.setPayPassword(userService.encodePassword(param.getPayPassword()));
     if (userService.updateById(update)) {
       // 核销已使用的验证码
-      cacheClient.delete(param.getPhone());
+      redisUtil.delete(verifyKey);
       return success("支付密码重置成功");
     }
     return fail("重置失败");