diff --git a/backend/app/api/wecom.py b/backend/app/api/wecom.py
index eddbd14..1b34add 100644
--- a/backend/app/api/wecom.py
+++ b/backend/app/api/wecom.py
@@ -4,6 +4,7 @@ import base64
 import uuid
 from typing import Optional
 from fastapi import APIRouter, Depends, HTTPException, Query, Request
+from fastapi.responses import PlainTextResponse
 from pydantic import BaseModel
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy import select
@@ -73,7 +74,8 @@ async def wecom_callback_verify(
 
     try:
         plaintext = _decrypt_echostr(echostr)
-        return plaintext
+        # Must return raw plaintext (not JSON) — WeChat Work requires exact match
+        return PlainTextResponse(content=plaintext, status_code=200)
     except Exception as e:
         raise HTTPException(status_code=500, detail=f"Decrypt failed: {e}")