diff --git a/config/nacos/cn/baiyue-common.yml b/config/nacos/cn/baiyue-common.yml
index 80b7c9d75..534b74de1 100644
--- a/config/nacos/cn/baiyue-common.yml
+++ b/config/nacos/cn/baiyue-common.yml
@@ -55,6 +55,7 @@ logging:
     path: ${LOG_PATH:/app/logs}
 server:
   shutdown: graceful
+  max-http-request-header-size: ${SERVER_MAX_HTTP_REQUEST_HEADER_SIZE:32KB}
 management:
   endpoints:
     web:
diff --git a/config/nacos/local/baiyue-common.yml b/config/nacos/local/baiyue-common.yml
index 82059af44..cf5ab9245 100644
--- a/config/nacos/local/baiyue-common.yml
+++ b/config/nacos/local/baiyue-common.yml
@@ -50,7 +50,9 @@ spring:
 logging:
   file:
     path: ${LOG_PATH:./logs}
-server.shutdown: graceful
+server:
+  shutdown: graceful
+  max-http-request-header-size: ${SERVER_MAX_HTTP_REQUEST_HEADER_SIZE:32KB}
 management:
   endpoints.web.exposure.include: health,info,prometheus
   endpoint.health:
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index a9c5b5c37..6fd9ea08f 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -19,6 +19,7 @@ x-common: &common
     REDIS_DATABASE: ${REDIS_DATABASE:-0}
     JWT_SECRET: ${JWT_SECRET}
     INTERNAL_SERVICE_TOKEN: ${INTERNAL_SERVICE_TOKEN}
+    SERVER_MAX_HTTP_REQUEST_HEADER_SIZE: ${SERVER_MAX_HTTP_REQUEST_HEADER_SIZE:-32KB}
     AUDIT_OUTBOX_ENABLED: ${AUDIT_OUTBOX_ENABLED:-false}
     AUDIT_OUTBOX_PUBLISHER_ENABLED: ${AUDIT_OUTBOX_PUBLISHER_ENABLED:-false}
     REGION_CODE: ${REGION_CODE:-CN}
diff --git a/gateway/src/test/java/com/baiyue/gateway/config/DeploymentHeaderSizeContractTest.java b/gateway/src/test/java/com/baiyue/gateway/config/DeploymentHeaderSizeContractTest.java
new file mode 100644
index 000000000..38549c6f4
--- /dev/null
+++ b/gateway/src/test/java/com/baiyue/gateway/config/DeploymentHeaderSizeContractTest.java
@@ -0,0 +1,31 @@
+package com.baiyue.gateway.config;
+
+import org.junit.jupiter.api.Test;
+
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class DeploymentHeaderSizeContractTest {
+    private static final String PROPERTY =
+            "max-http-request-header-size: ${SERVER_MAX_HTTP_REQUEST_HEADER_SIZE:32KB}";
+    private static final String ENVIRONMENT =
+            "SERVER_MAX_HTTP_REQUEST_HEADER_SIZE: ${SERVER_MAX_HTTP_REQUEST_HEADER_SIZE:-32KB}";
+
+    @Test
+    void allowsAuthorizationTokensAndTrustedIdentityHeadersAcrossAllServices() throws Exception {
+        assertThat(readRepositoryFile("deploy", "docker-compose.yml")).contains(ENVIRONMENT);
+        assertThat(readRepositoryFile("config", "nacos", "cn", "baiyue-common.yml")).contains(PROPERTY);
+        assertThat(readRepositoryFile("config", "nacos", "local", "baiyue-common.yml")).contains(PROPERTY);
+    }
+
+    private static String readRepositoryFile(String first, String... more) throws Exception {
+        Path path = Path.of(first, more);
+        if (!Files.exists(path)) {
+            path = Path.of("..").resolve(path).normalize();
+        }
+        return Files.readString(path, StandardCharsets.UTF_8);
+    }
+}