diff --git a/src/main/java/com/cisd/tms/modules/auth/service/impl/AuthAdminServiceImpl.java b/src/main/java/com/cisd/tms/modules/auth/service/impl/AuthAdminServiceImpl.java
index 8f4ee45..003df46 100644
--- a/src/main/java/com/cisd/tms/modules/auth/service/impl/AuthAdminServiceImpl.java
+++ b/src/main/java/com/cisd/tms/modules/auth/service/impl/AuthAdminServiceImpl.java
@@ -34,6 +34,7 @@ import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
 import java.util.stream.Collectors;
+import java.util.stream.Stream;
 import lombok.RequiredArgsConstructor;
 import org.springframework.stereotype.Service;
 
@@ -129,12 +130,14 @@ public class AuthAdminServiceImpl implements AuthAdminService {
         String normalizedRoleFilter = normalizeRoleFilter(roleCode, rolesByCode);
         String normalizedStatusFilter = normalizeStatusFilter(status);
         List<AuthUserListItemResponse> filteredItems = accounts.stream()
-                .map(account -> toUserListItem(account, rolesByCode.get(account.getRoleCode())))
+                .flatMap(account -> toUserListItems(account, rolesByCode.get(account.getRoleCode())))
                 .filter(item -> normalizedRoleFilter == null || normalizedRoleFilter.equals(item.getRoleCode()))
                 .filter(item -> normalizedStatusFilter == null || normalizedStatusFilter.equals(item.getStatus()))
                 .sorted(Comparator
                         .comparingInt((AuthUserListItemResponse item) -> roleOrder(item.getRoleCode()))
-                        .thenComparing(AuthUserListItemResponse::getUid, Comparator.nullsLast(Integer::compareTo)))
+                        .thenComparing(AuthUserListItemResponse::getUid, Comparator.nullsLast(Integer::compareTo))
+                        .thenComparing(AuthUserListItemResponse::getUkeyBindingId, Comparator.nullsLast(Long::compareTo))
+                        .thenComparing(AuthUserListItemResponse::getUkeySerialNo, Comparator.nullsLast(String::compareTo)))
                 .toList();
 
         int fromIndex = Math.min((normalizedPage - 1) * normalizedPageSize, filteredItems.size());
@@ -171,14 +174,18 @@ public class AuthAdminServiceImpl implements AuthAdminService {
         authFullAccountRepository.update(account);
     }
 
-    private AuthUserListItemResponse toUserListItem(AuthFullAccountEntity account, RoleAccountEntity role) {
-        List<String> ukeySerials = roleUkeyBindingRepository
+    private Stream<AuthUserListItemResponse> toUserListItems(AuthFullAccountEntity account, RoleAccountEntity role) {
+        List<RoleUkeyBindingEntity> bindings = roleUkeyBindingRepository
                 .findActiveByRoleCodeAndUid(account.getRoleCode(), account.getUid())
                 .stream()
-                .map(RoleUkeyBindingEntity::getUkeySerial)
-                .filter(Objects::nonNull)
-                .distinct()
                 .toList();
+        if (bindings.isEmpty()) {
+            return Stream.of(toUserListItem(account, role, null));
+        }
+        return bindings.stream().map(binding -> toUserListItem(account, role, binding));
+    }
+
+    private AuthUserListItemResponse toUserListItem(AuthFullAccountEntity account, RoleAccountEntity role, RoleUkeyBindingEntity binding) {
         String effectiveStatus = effectiveStatus(role, account);
         AuthUserListItemResponse item = new AuthUserListItemResponse();
         item.setRoleCode(account.getRoleCode());
@@ -191,8 +198,8 @@ public class AuthAdminServiceImpl implements AuthAdminService {
         item.setLastLoginAt(account.getLastLoginAt());
         item.setPasswordChangedAt(account.getPasswordChangedAt());
         item.setFailedCount(account.getFailedCount() == null ? 0 : account.getFailedCount());
-        item.setUkeySerials(ukeySerials);
-        item.setUkeySerialNo(String.join(",", ukeySerials));
+        item.setUkeyBindingId(binding == null ? null : binding.getId());
+        item.setUkeySerialNo(binding == null ? null : binding.getUkeySerial());
         return item;
     }
 
diff --git a/src/test/java/com/cisd/tms/modules/auth/controller/AuthControllerTest.java b/src/test/java/com/cisd/tms/modules/auth/controller/AuthControllerTest.java
index 2da35e6..e1c163c 100644
--- a/src/test/java/com/cisd/tms/modules/auth/controller/AuthControllerTest.java
+++ b/src/test/java/com/cisd/tms/modules/auth/controller/AuthControllerTest.java
@@ -262,8 +262,8 @@ class AuthControllerTest {
         item.setUsername("super-admin-full-01");
         item.setStatus("ACTIVE");
         item.setStatusName("正常");
-        item.setUkeySerials(java.util.List.of("UK-PRIMARY", "UK-BACKUP"));
-        item.setUkeySerialNo("UK-PRIMARY,UK-BACKUP");
+        item.setUkeyBindingId(1001L);
+        item.setUkeySerialNo("UK-PRIMARY");
         AuthUserListResponse response = new AuthUserListResponse();
         response.setPage(1);
         response.setPageSize(10);
@@ -286,7 +286,8 @@ class AuthControllerTest {
                 .andExpect(status().isOk())
                 .andExpect(content().string(containsString("\"roleCode\":\"SUPER_ADMIN\"")))
                 .andExpect(content().string(containsString("\"username\":\"super-admin-full-01\"")))
-                .andExpect(content().string(containsString("\"ukeySerialNo\":\"UK-PRIMARY,UK-BACKUP\"")));
+                .andExpect(content().string(containsString("\"ukeyBindingId\":1001")))
+                .andExpect(content().string(containsString("\"ukeySerialNo\":\"UK-PRIMARY\"")));
 
         Mockito.verify(authAdminService).listUsers("SUPER_ADMIN", "ACTIVE", 1, 10);
     }
diff --git a/src/test/java/com/cisd/tms/modules/auth/service/AuthAdminServiceTest.java b/src/test/java/com/cisd/tms/modules/auth/service/AuthAdminServiceTest.java
index d25c0d7..b8c0453 100644
--- a/src/test/java/com/cisd/tms/modules/auth/service/AuthAdminServiceTest.java
+++ b/src/test/java/com/cisd/tms/modules/auth/service/AuthAdminServiceTest.java
@@ -187,7 +187,7 @@ class AuthAdminServiceTest {
     }
 
     @Test
-    void shouldListUsersWithEffectiveStatusAndUkeySerials() {
+    void shouldListUsersExpandedByUkeyBindingWithEffectiveStatus() {
         InMemoryRoleAccountRepository roles = new InMemoryRoleAccountRepository();
         InMemoryAuthFullAccountRepository accounts = new InMemoryAuthFullAccountRepository();
         InMemoryRoleUkeyBindingRepository bindings = new InMemoryRoleUkeyBindingRepository();
@@ -217,14 +217,14 @@ class AuthAdminServiceTest {
 
         Assertions.assertEquals(1, response.getPage());
         Assertions.assertEquals(10, response.getPageSize());
-        Assertions.assertEquals(1, response.getTotal());
+        Assertions.assertEquals(2, response.getTotal());
         Assertions.assertEquals("SUPER_ADMIN", response.getItems().get(0).getRoleCode());
         Assertions.assertEquals(1, response.getItems().get(0).getUid());
         Assertions.assertEquals("超级管理员", response.getItems().get(0).getRoleName());
         Assertions.assertEquals("super-admin-full-01", response.getItems().get(0).getUsername());
         Assertions.assertEquals("正常", response.getItems().get(0).getStatusName());
-        Assertions.assertEquals(List.of("UK-PRIMARY", "UK-BACKUP"), response.getItems().get(0).getUkeySerials());
-        Assertions.assertEquals("UK-PRIMARY,UK-BACKUP", response.getItems().get(0).getUkeySerialNo());
+        Assertions.assertEquals("UK-BACKUP", response.getItems().get(0).getUkeySerialNo());
+        Assertions.assertEquals("UK-PRIMARY", response.getItems().get(1).getUkeySerialNo());
 
         var disabledResponse = service(roles, accounts, bindings, Mockito.mock(LmkService.class))
                 .listUsers(null, "未启用", 1, 10);
@@ -232,6 +232,7 @@ class AuthAdminServiceTest {
         Assertions.assertEquals(1, disabledResponse.getTotal());
         Assertions.assertEquals("AUDIT_ADMIN", disabledResponse.getItems().get(0).getRoleCode());
         Assertions.assertEquals("UNENABLED", disabledResponse.getItems().get(0).getStatus());
+        Assertions.assertNull(disabledResponse.getItems().get(0).getUkeySerialNo());
     }
 
     private static AuthAdminService service(