diff --git a/server/auth/licenses.py b/server/auth/licenses.py
index 62a6594..28c025e 100644
--- a/server/auth/licenses.py
+++ b/server/auth/licenses.py
@@ -359,6 +359,8 @@ class CodeLicenseProvider(LicenseProvider):
         }
         configured = (os.environ.get("APS_LICENSE_CODES") or "").strip()
         if not configured:
+            # 无环境变量发码时也必须合并面板发放的 DB 授权码，否则新码无法激活
+            catalog.update(self._db_codes())
             return catalog
         try:
             data = json.loads(configured)
diff --git a/tests/golden/test_web_license_codes_auth.py b/tests/golden/test_web_license_codes_auth.py
index 06a1bca..0df00f8 100644
--- a/tests/golden/test_web_license_codes_auth.py
+++ b/tests/golden/test_web_license_codes_auth.py
@@ -270,6 +270,22 @@ def test_admin_issues_code_and_user_activates_with_name(codes_app):
     assert entry["activation"]["status"] == "active"
 
 
+def test_panel_issued_code_activates_without_env_codes(codes_app, monkeypatch):
+    """回归：未配置 APS_LICENSE_CODES 时，面板发放的 DB 授权码也必须可激活。"""
+    monkeypatch.delenv("APS_LICENSE_CODES", raising=False)
+    admin = _admin_client(codes_app)
+    created = admin.post("/api/admin/license/codes", json={
+        "name": "无环境配置", "licenseType": "year",
+    })
+    assert created.status_code == 200
+    issued = created.json()["code"]
+
+    user = TestClient(codes_app)
+    response = user.post("/api/auth/license/activate", json={"code": issued["code"]})
+    assert response.status_code == 200
+    assert response.json()["user"]["fullname"] == "无环境配置"
+
+
 def test_non_admin_cannot_manage_codes(codes_app):
     user = TestClient(codes_app)
     assert user.post("/api/auth/license/activate", json={"code": "USER-CODE-ALPHA"}).status_code == 200