diff --git a/backend/services/themes.py b/backend/services/themes.py
index e9380b8..e66290e 100644
--- a/backend/services/themes.py
+++ b/backend/services/themes.py
@@ -30,12 +30,23 @@ _PZ_CDN_URL = "https://emcfgdata.securities.eastmoney.com"
 _APP_KEY_INDEX = "rn-themeIndex"
 _APP_KEY_DETAIL = "rn-themeDetail"
 
+# 完整浏览器请求头：生产实测东财对缺 sec-* 头的移动端包装结构请求会 403，
+# 补齐真实 Chrome 头 + client="web" 后正常返回
 _HEADERS = {
-    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
-    "Origin": "https://emrnweb.eastmoney.com",
-    "Referer": "https://emrnweb.eastmoney.com/",
-    "Accept": "application/json",
+    "Accept": "application/json, text/plain, */*",
     "Accept-Language": "zh-CN,zh;q=0.9",
+    "Content-Type": "application/json;charset=UTF-8",
+    "DNT": "1",
+    "Origin": "https://emrnweb.eastmoney.com",
+    "Priority": "u=1, i",
+    "Referer": "https://emrnweb.eastmoney.com/",
+    "Sec-Ch-Ua": '"Not=A?Brand";v="99", "Google Chrome";v="151", "Chromium";v="151"',
+    "Sec-Ch-Ua-Mobile": "?0",
+    "Sec-Ch-Ua-Platform": '"macOS"',
+    "Sec-Fetch-Dest": "empty",
+    "Sec-Fetch-Mode": "cors",
+    "Sec-Fetch-Site": "same-site",
+    "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
 }
 
 # ---- 交易时段感知缓存 ----
@@ -89,7 +100,7 @@ def _build_payload(args: Optional[dict] = None, app_key: str = _APP_KEY_INDEX) -
     return {
         "args": args or {},
         "appKey": app_key,
-        "client": "iOS",
+        "client": "web",  # 生产实测 iOS client 会 403，web + 完整浏览器头正常
         "clientVersion": "8.3",
         "clientType": "cfw",
         "randomCode": "".join(random.choices(string.ascii_uppercase + string.ascii_lowercase + string.digits, k=16)),