diff --git a/internal/routes/asset_auto_renewal.go b/internal/routes/asset_auto_renewal.go
index 29495d3..8584bed 100644
--- a/internal/routes/asset_auto_renewal.go
+++ b/internal/routes/asset_auto_renewal.go
@@ -13,8 +13,10 @@ import (
 
 // registerAssetAutoRenewalRoutes 注册资产钱包自动续费配置的读写路由。
 // 沿用超管/平台路由组级 gate 先例：代理、企业与个人客户账号一律 403，无任何读取或修改入口。
+// gate 必须挂在功能路径组上：Fiber 的组中间件按路径前缀生效，挂在空路径组上会落到
+// /api/admin 前缀，从而拦截该层其余全部接口。
 func registerAssetAutoRenewalRoutes(router fiber.Router, handler *admin.AssetAutoRenewalConfigHandler, doc *openapi.Generator, basePath string) {
-	group := router.Group("", func(c *fiber.Ctx) error {
+	group := router.Group("/asset-auto-renewal-config", func(c *fiber.Ctx) error {
 		userType := middleware.GetUserTypeFromContext(c.UserContext())
 		if userType != constants.UserTypeSuperAdmin && userType != constants.UserTypePlatform {
 			return errors.New(errors.CodeForbidden, constants.PlatformManagementForbiddenMessage)
diff --git a/internal/routes/package_traffic_alert.go b/internal/routes/package_traffic_alert.go
index b5f6f21..014d2a6 100644
--- a/internal/routes/package_traffic_alert.go
+++ b/internal/routes/package_traffic_alert.go
@@ -13,16 +13,18 @@ import (
 
 // registerPackageTrafficAlertRoutes 注册套餐真流量预警规则与达量预警路由。
 // 沿用超管/平台路由组级 gate 先例：代理、企业与个人客户账号一律 403。
+// gate 必须挂在功能路径组上：Fiber 的组中间件按路径前缀生效，挂在空路径组上会落到
+// /api/admin 前缀，从而拦截该层其余全部接口。
 func registerPackageTrafficAlertRoutes(router fiber.Router, handler *admin.PackageTrafficAlertHandler, doc *openapi.Generator, basePath string) {
-	group := router.Group("", func(c *fiber.Ctx) error {
+	gate := func(c *fiber.Ctx) error {
 		userType := middleware.GetUserTypeFromContext(c.UserContext())
 		if userType != constants.UserTypeSuperAdmin && userType != constants.UserTypePlatform {
 			return errors.New(errors.CodeForbidden, constants.PlatformManagementForbiddenMessage)
 		}
 		return c.Next()
-	})
+	}
 
-	ruleGroup := group.Group("/package-traffic-alert-rules")
+	ruleGroup := router.Group("/package-traffic-alert-rules", gate)
 	rulePath := basePath + "/package-traffic-alert-rules"
 
 	Register(ruleGroup, doc, rulePath, "GET", "", handler.ListRules, RouteSpec{
@@ -52,7 +54,7 @@ func registerPackageTrafficAlertRoutes(router fiber.Router, handler *admin.Packa
 		Auth:        true,
 	})
 
-	alertGroup := group.Group("/package-traffic-alerts")
+	alertGroup := router.Group("/package-traffic-alerts", gate)
 	alertPath := basePath + "/package-traffic-alerts"
 
 	Register(alertGroup, doc, alertPath, "GET", "", handler.ListAlerts, RouteSpec{