diff --git a/backend/routes/tickets.js b/backend/routes/tickets.js
index 7ed3aae..d3a8402 100644
--- a/backend/routes/tickets.js
+++ b/backend/routes/tickets.js
@@ -181,6 +181,7 @@ router.post('/', optionalAuth, upload.array('files', 5), finalizeUpload, validat
 router.put('/:id', authenticate, requireRole('owner','admin'), async (req, res) => {
   const t = await getRow('SELECT * FROM tickets WHERE id = ?', [req.params.id]);
   if (!t) return res.status(404).json({ error: '工单不存在' });
+  if (req.user.role === 'admin' && t.assigned_to && t.assigned_to !== req.user.id) return res.status(403).json({ error: '只能修改自己负责的工单' });
   if (t.status === 'closed' && req.user.role !== 'owner') return res.status(400).json({ error: '已关闭的工单仅服主可操作' });
   const fields = {};
   if (req.body.status) fields.status = req.body.status;