diff --git a/bin/clawd.js b/bin/clawd.js
index 559193a..5a3fc47 100755
--- a/bin/clawd.js
+++ b/bin/clawd.js
@@ -11,6 +11,22 @@ const config = require('../lib/config');
 const log = require('../lib/logger');
 const { pollSms } = require('../drivers/sim/sms-reader');
 
+// 修复旧版 clawd.service：确保 ReadWritePaths 包含 /etc/hosts /etc/hostname
+const SERVICE_FILE = '/etc/systemd/system/clawd.service';
+const fs = require('fs');
+try {
+  const svc = fs.readFileSync(SERVICE_FILE, 'utf8');
+  if (svc.includes('ReadWritePaths=') && !svc.includes('/etc/hosts')) {
+    const fixed = svc.replace(
+      /ReadWritePaths=([^\n]*)/,
+      (_, rest) => `ReadWritePaths=${rest.trimEnd()} /etc/hosts /etc/hostname`
+    );
+    fs.writeFileSync(SERVICE_FILE, fixed, 'utf8');
+    exec('systemctl daemon-reload', () => {});
+    log.info('clawd', 'clawd.service ReadWritePaths patched');
+  }
+} catch (_) { /* not running under systemd or no permission */ }
+
 // 每次启动绑定 Quectel 串口驱动（失败不影响主流程）
 const bindScript = path.join(__dirname, '..', 'tools', 'bind-quectel-serial.sh');
 exec(`bash "${bindScript}"`, (err, stdout, stderr) => {
diff --git a/package.json b/package.json
index eb5573a..9bf41a2 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "clawd",
-  "version": "1.2.6",
+  "version": "1.2.7",
   "description": "Claw Box daemon - connects local Linux box to claw.cutos.ai via WebSocket",
   "main": "lib/client.js",
   "bin": {