diff --git a/db.js b/db.js
index a46d845..ab5eee2 100644
--- a/db.js
+++ b/db.js
@@ -236,6 +236,24 @@ async function initDB() {
   await seedDepartmentsAndPermissions()
   await seedDefaultUsers()
   await seedBusinessData()
+
+  // ============ 2.5 数据库迁移（兼容已有数据的旧库） ============
+  // 为财务部补上 product:read 权限
+  try {
+    const [financeDept] = await pool.query("SELECT id FROM departments WHERE name = 'finance' LIMIT 1")
+    if (financeDept.length > 0) {
+      const [prodPerm] = await pool.query("SELECT id FROM permissions WHERE name = 'product:read' LIMIT 1")
+      if (prodPerm.length > 0) {
+        await pool.query(
+          'INSERT IGNORE INTO department_permissions (department_id, permission_id) VALUES (?, ?)',
+          [financeDept[0].id, prodPerm[0].id]
+        )
+        console.log('[migrate] 财务部已补上 product:read 权限')
+      }
+    }
+  } catch (e) {
+    console.log('[migrate] 财务部权限迁移跳过:', e.message)
+  }
 }
 
 // ============ 3. 种子数据：部门与权限 ============
@@ -317,7 +335,7 @@ async function seedDepartmentsAndPermissions() {
       'employee:read',
     ],
     finance: [
-      'customer:read', 'contract:read', 'after_sale:read', 'employee:read',
+      'customer:read', 'contract:read', 'after_sale:read', 'product:read', 'employee:read',
     ],
   }