diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/FleetTripAuthorizationTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/FleetTripAuthorizationTest.java
index 910d83b73..e43e900e1 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/FleetTripAuthorizationTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/FleetTripAuthorizationTest.java
@@ -12,20 +12,23 @@ import static org.assertj.core.api.Assertions.*;
 import static org.mockito.Mockito.*;
 
 class FleetTripAuthorizationTest {
-    @Test void calendarRequiresTripReadPermissionThroughMethodSecurity() {
+    /** 日历按现行排车只读权限放行，预约和旧车次权限不能替代。 */
+    @Test void calendarRequiresDispatchReadPermissionThroughMethodSecurity() {
         try (var context = new AnnotationConfigApplicationContext(Config.class)) {
             var controller = context.getBean(PlatformFleetTripController.class);
             var calendar = context.getBean(FleetTripCalendarService.class);
             var from = java.time.Instant.parse("2026-10-01T00:00:00Z");
             var to = from.plusSeconds(86400);
             var user = new com.baiyue.common.security.AuthenticatedUser(1L, 0L, 0L, 1L,
-                "platform", "PLATFORM", "WEB", java.util.Set.of("platform:fleet:trip:list"));
-            SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(
-                user, "unused", List.of(new SimpleGrantedAuthority("platform:appointment:list"))));
-            assertThatThrownBy(() -> controller.calendar(user, from, to)).isInstanceOf(AccessDeniedException.class);
+                "platform", "PLATFORM", "WEB", java.util.Set.of("platform:overseas-warehouse:dispatch:list"));
+            for (var permission : List.of("platform:appointment:list", "platform:fleet:trip:list")) {
+                SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(
+                    user, "unused", List.of(new SimpleGrantedAuthority(permission))));
+                assertThatThrownBy(() -> controller.calendar(user, from, to)).isInstanceOf(AccessDeniedException.class);
+            }
             verifyNoInteractions(calendar);
             SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(
-                user, "unused", List.of(new SimpleGrantedAuthority("platform:fleet:trip:list"))));
+                user, "unused", List.of(new SimpleGrantedAuthority("platform:overseas-warehouse:dispatch:list"))));
             controller.calendar(user, from, to);
             verify(calendar).calendar(from, to);
         } finally { SecurityContextHolder.clearContext(); }