diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/policy/RouteSecurityPolicyRegistry.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/policy/RouteSecurityPolicyRegistry.java
index 6f9daa3b..dff144af 100644
--- a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/policy/RouteSecurityPolicyRegistry.java
+++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/policy/RouteSecurityPolicyRegistry.java
@@ -301,6 +301,8 @@ public class RouteSecurityPolicyRegistry {
             "ANY /api/v1/auth/direct/login",
             "ANY /api/v1/auth/local/**",
             "ANY /api/v1/admin/**",
+            "POST /api/v1/skills/avatar-uploads",
+            "POST /api/web/skills/avatar-uploads",
             "POST /api/v1/suites/reviews/*/approve",
             "POST /api/v1/suites/reviews/*/reject",
             "POST /api/web/suites/reviews/*/approve",
diff --git a/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/policy/RouteSecurityPolicyRegistryTest.java b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/policy/RouteSecurityPolicyRegistryTest.java
index 949a9710..c090615f 100644
--- a/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/policy/RouteSecurityPolicyRegistryTest.java
+++ b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/policy/RouteSecurityPolicyRegistryTest.java
@@ -48,6 +48,18 @@ class RouteSecurityPolicyRegistryTest {
                 registry.accessLevel("GET", "/api/web/skills/avatar-review/queue"));
     }
 
+    @Test
+    void stagedAvatarUploadRequiresSessionWhilePreviewRequiresAnAuthenticatedUploader() {
+        for (String prefix : List.of("/api/v1", "/api/web")) {
+            String upload = prefix + "/skills/avatar-uploads";
+            assertEquals(RouteSecurityPolicyRegistry.AccessLevel.AUTHENTICATED, registry.accessLevel("POST", upload));
+            assertTrue(registry.sessionOnlyRoutes().contains("POST " + upload));
+            assertFalse(registry.authorizeApiToken("POST", upload, ALL_SCOPES).allowed());
+            assertEquals(RouteSecurityPolicyRegistry.AccessLevel.AUTHENTICATED,
+                    registry.accessLevel("GET", upload + "/upload-id/image"));
+        }
+    }
+
     @Test
     void reviewRoutesExposePublicListingButProtectCurrentUserMutations() {
         assertEquals(RouteSecurityPolicyRegistry.AccessLevel.PERMIT_ALL,