diff --git a/server-go/internal/service/s3.go b/server-go/internal/service/s3.go
index 8ee4fbf..1e3a14c 100644
--- a/server-go/internal/service/s3.go
+++ b/server-go/internal/service/s3.go
@@ -152,18 +152,24 @@ func (s *S3Service) UploadFile(bucket, key, filePath string) error {
 	return err
 }
 
-// EnsureBucket 确保 bucket 存在，不存在则创建（幂等）
+// EnsureBucket 确保 bucket 存在（不存在则创建），并设为公开读。
+// 知识库图谱图片属公开内容（Web/小程序直接展示），生产切云 OSS 时同理由 OSS/COS 配置或 CDN 承担。
 func (s *S3Service) EnsureBucket(bucket string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
-	if _, err := s.client.HeadBucket(ctx, &s3.HeadBucketInput{Bucket: aws.String(bucket)}); err == nil {
-		return nil
+	if _, err := s.client.HeadBucket(ctx, &s3.HeadBucketInput{Bucket: aws.String(bucket)}); err != nil {
+		if _, err := s.client.CreateBucket(ctx, &s3.CreateBucketInput{Bucket: aws.String(bucket)}); err != nil {
+			return err
+		}
 	}
-	_, err := s.client.CreateBucket(ctx, &s3.CreateBucketInput{Bucket: aws.String(bucket)})
+	_, err := s.client.PutBucketAcl(ctx, &s3.PutBucketAclInput{
+		Bucket: aws.String(bucket),
+		ACL:    types.BucketCannedACLPublicRead,
+	})
 	return err
 }
 
-// UploadImage 上传图片对象（支持指定 Content-Type）
+// UploadImage 上传图片对象（支持指定 Content-Type，对象设为公开读供 Web/小程序直接展示）
 func (s *S3Service) UploadImage(bucket, key string, body io.Reader, contentType string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
@@ -172,6 +178,7 @@ func (s *S3Service) UploadImage(bucket, key string, body io.Reader, contentType
 		Key:         aws.String(key),
 		Body:        body,
 		ContentType: aws.String(contentType),
+		ACL:         types.ObjectCannedACLPublicRead,
 	})
 	return err
 }