diff --git a/src/main/java/com/cisd/tms/common/config/WebMvcConfig.java b/src/main/java/com/cisd/tms/common/config/WebMvcConfig.java
index e982049..db3c0c5 100644
--- a/src/main/java/com/cisd/tms/common/config/WebMvcConfig.java
+++ b/src/main/java/com/cisd/tms/common/config/WebMvcConfig.java
@@ -106,9 +106,12 @@ public class WebMvcConfig implements WebMvcConfigurer {
                         "/api/v1/auth/ukey-login/randoms",
                         "/api/v1/auth/captcha",
                         "/api/v1/auth/super-admin/ukeys/issue-sign",
-                        "/api/v1/device/network/**"
+                        "/api/v1/device/network/**",
+                        "/api/v1/masterKey/activate",
+                        "/api/v1/masterKey/activate/info"
                 );
 
+
         registry.addInterceptor(internalApiReplayInterceptor)
                 .addPathPatterns("/api/**");
 
diff --git a/src/main/java/com/cisd/tms/modules/mk/service/impl/LmkServiceImpl.java b/src/main/java/com/cisd/tms/modules/mk/service/impl/LmkServiceImpl.java
index 7e17b4e..808fa8c 100644
--- a/src/main/java/com/cisd/tms/modules/mk/service/impl/LmkServiceImpl.java
+++ b/src/main/java/com/cisd/tms/modules/mk/service/impl/LmkServiceImpl.java
@@ -233,6 +233,18 @@ public class LmkServiceImpl implements LmkService {
         if (pcieCryptoService.checkLmk()) {
             throw new BizException(ErrorCode.CONFLICT.getCode(), "主密钥已存在，拒绝重新初始化");
         }
+
+        MasterKeyActivateEntity masterKeyActivateEntity = masterKeyActivateRepository.find().
+                orElseThrow(() -> new BizException(ErrorCode.VALIDATE_FAILED.getCode(), "激活记录不存在"));
+        boolean everInitialized = masterKeyActivateEntity.getEverInitialized();
+        boolean activationStatus = masterKeyActivateEntity.getActivationStatus();
+        if (!everInitialized) {
+            if (!activationStatus) {
+                throw new BizException(ErrorCode.FORBIDDEN.getCode(), "需要先进行激活");
+            }
+        }
+
+
         // 进入恢复流程后，旧的备份轮次缓存不再可信，避免和恢复后的新密钥体系混用。
         clearCachedBackupRound();
         // 调用方可以任意顺序传入两份包，这里统一按 packetIndex 排序并校验必须是 1、2 两包。
@@ -259,6 +271,15 @@ public class LmkServiceImpl implements LmkService {
         MasterKeyStateResult result = new MasterKeyStateResult();
         result.setStatus(true);
         result.setSeedMac(Hex.toHexString(recoveryResult.getLmkSeedMac()));
+
+        try {
+            masterKeyActivateEntity.setActivationStatus(false);
+            masterKeyActivateEntity.setEverInitialized(false);
+            masterKeyActivateRepository.update(masterKeyActivateEntity);
+        } catch (RuntimeException ex) {
+            log.error("主密钥恢复后更新激活记录失败", ex);
+        }
+
         return result;
     }