diff --git a/main.py b/main.py
index 656ae12..c8698aa 100644
--- a/main.py
+++ b/main.py
@@ -8,8 +8,7 @@ from contextlib import asynccontextmanager
 
 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import HTMLResponse
-from fastapi.staticfiles import StaticFiles
+from fastapi.responses import FileResponse, HTMLResponse, PlainTextResponse
 from tortoise import Tortoise
 from tortoise.contrib.fastapi import register_tortoise
 
@@ -75,12 +74,6 @@ async def lifespan(app: FastAPI):
     # 加载配置（多进程下串行化启动写操作）
     async with db_startup_lock():
         await load_config()
-    app.mount(
-        "/assets",
-        StaticFiles(directory=f"./{settings.themesSelect}/assets"),
-        name="assets",
-    )
-
     # 启动后台任务
     task = asyncio.create_task(delete_expire_files())
     chunk_cleanup_task = asyncio.create_task(clean_incomplete_uploads())
@@ -154,6 +147,22 @@ app.include_router(presign_api, prefix="/api")
 app.include_router(admin_api)
 
 
+@app.get("/assets/{asset_path:path}")
+async def theme_asset(asset_path: str):
+    theme_assets = (BASE_DIR / settings.themesSelect / "assets").resolve()
+    target = (theme_assets / asset_path).resolve()
+    try:
+        target.relative_to(theme_assets)
+    except ValueError:
+        return PlainTextResponse("Not found", status_code=404)
+    if not target.is_file():
+        return PlainTextResponse("Not found", status_code=404)
+    return FileResponse(
+        target,
+        headers={"Cache-Control": "public, max-age=31536000, immutable"},
+    )
+
+
 @app.exception_handler(404)
 @app.get("/")
 async def index(request=None, exc=None):