diff --git a/static/pdf.html b/static/pdf.html
index adf770d..d0f0c2c 100644
--- a/static/pdf.html
+++ b/static/pdf.html
@@ -36,7 +36,7 @@
     <div class="skel">加载中…</div>
   </div>
 
-  <p class="foot"><a class="link" href="/pdf-admin">管理页</a> · zikai file service</p>
+  <p class="foot">zikai file service</p>
 </div>
 <script src="/static/common.js"></script>
 <script src="/static/pdf.js"></script>
diff --git a/tests/test_pdf_service.py b/tests/test_pdf_service.py
index e6a184e..f577bfb 100644
--- a/tests/test_pdf_service.py
+++ b/tests/test_pdf_service.py
@@ -153,6 +153,10 @@ def _wait_done(client, job_id, cookie, timeout=60):
     raise AssertionError(f"任务未在 {timeout}s 内完成，最后状态: {last}")
 
 
+# 管理页 Basic Auth 凭据（与 config.yaml 的 docs 段保持一致）
+ADMIN_AUTH = ("a", "66511315")
+
+
 # ---------------- 测试 ----------------
 
 
@@ -240,8 +244,7 @@ class TestDeleteSemantics:
         assert lst.json()["total"] == 0
 
         # 管理页仍可见且标注已删除
-        admin_auth = ("admin", "testpass123")
-        al = client.get("/api/admin/pdf/jobs", auth=admin_auth)
+        al = client.get("/api/admin/pdf/jobs", auth=ADMIN_AUTH)
         assert al.status_code == 200
         items = al.json()["items"]
         assert any(it["id"] == job_id and it["user_deleted"] is True for it in items)
@@ -252,20 +255,20 @@ class TestDeleteSemantics:
         assert dl.status_code == 404
 
         # 管理员硬删
-        ad = client.delete(f"/api/admin/pdf/jobs/{job_id}", auth=admin_auth)
+        ad = client.delete(f"/api/admin/pdf/jobs/{job_id}", auth=ADMIN_AUTH)
         assert ad.status_code == 200
         assert ad.json()["deleted"] is True
 
         # 管理页也不再可见
-        al2 = client.get("/api/admin/pdf/jobs", auth=admin_auth)
+        al2 = client.get("/api/admin/pdf/jobs", auth=ADMIN_AUTH)
         assert not any(it["id"] == job_id for it in al2.json()["items"])
 
     def test_admin_requires_auth(self, client):
         r = client.get("/api/admin/pdf/jobs")
         assert r.status_code == 401
-        r = client.get("/api/admin/pdf/jobs", auth=("admin", "wrong"))
+        r = client.get("/api/admin/pdf/jobs", auth=("a", "wrong"))
         assert r.status_code == 401
-        r = client.get("/api/admin/pdf/jobs", auth=("admin", "testpass123"))
+        r = client.get("/api/admin/pdf/jobs", auth=ADMIN_AUTH)
         assert r.status_code == 200
 
     def test_user_cannot_access_others_job(self, client):