diff --git a/GVSDServiceServer/apps/sub_server/views.py b/GVSDServiceServer/apps/sub_server/views.py
index c66cd213..6b0b5a48 100644
--- a/GVSDServiceServer/apps/sub_server/views.py
+++ b/GVSDServiceServer/apps/sub_server/views.py
@@ -100,18 +100,23 @@ class VenomRemoteEntryView(APIView):
 class DeclarePageView(APIView):
     """用「产品 API Key + 密钥」调用主服务器，声明本产品定制页的远端入口
 
-    POST /api/sub/declare-page/  {RemoteEntry?, RemoteModule?}
+    POST /api/sub/declare-page/  {ApiKey?, Secret?, RemoteEntry?, RemoteModule?}
     —— 先 Ping 验证鉴权，再 DeclareCustomPage 登记远端入口。
+
+    凭据优先取请求体（便于 rebuild-venom.ps1 一键重建+声明时按次传入），
+    缺省回落到本服务环境变量（SUBSCRIPTION_API_KEY / SUBSCRIPTION_SECRET）。
+    主服务器登记入口的同时会清空该产品的资源缓存，故重新声明 = 重建产物立即生效。
     """
 
     def post(self, request):
         from gvsdsdk.subscription import SubscriptionClient, SubscriptionClientError
 
-        api_key = settings.SUBSCRIPTION_API_KEY
-        secret = settings.SUBSCRIPTION_SECRET
+        api_key = (request.data.get('ApiKey') or settings.SUBSCRIPTION_API_KEY or '').strip()
+        secret = (request.data.get('Secret') or settings.SUBSCRIPTION_SECRET or '').strip()
         if not api_key or not secret:
             return Response(
-                _err('未配置 SUBSCRIPTION_API_KEY / SUBSCRIPTION_SECRET（请用环境变量注入）', 500),
+                _err('缺少订阅凭据：请在请求体传 ApiKey/Secret，或注入环境变量 '
+                     'SUBSCRIPTION_API_KEY / SUBSCRIPTION_SECRET', 500),
                 status=500,
             )
 
diff --git a/GVSDServiceServer/rebuild-venom.ps1 b/GVSDServiceServer/rebuild-venom.ps1
new file mode 100644
index 00000000..1bc5a29c
--- /dev/null
+++ b/GVSDServiceServer/rebuild-venom.ps1
@@ -0,0 +1,75 @@
+# Venom custom page: one-click rebuild + redeclare
+#
+# IMPORTANT: keep this file pure ASCII. PS 5.1 parses BOM-less UTF-8 files using the
+# ANSI codepage, so non-ASCII text would be garbled (same rule as GERP/deploy.ps1).
+#
+# What it does:
+#   1. npm run build in venom_ui -> dist/venom-entry.js (served by GVSDServiceServer)
+#   2. POST /api/sub/declare-page/ with the product credentials -> the master server
+#      re-registers the remote entry AND purges that product's remote-asset cache,
+#      so the new bundle takes effect immediately (no 24h TTL wait).
+#
+# Usage:
+#   .\rebuild-venom.ps1                                  # creds from env
+#   .\rebuild-venom.ps1 -ApiKey <key> -Secret <secret>    # creds as params
+#   .\rebuild-venom.ps1 -SkipDeclare                      # build only
+#
+# Env fallback: SUBSCRIPTION_API_KEY / SUBSCRIPTION_SECRET
+
+param(
+    [string]$ApiKey = '',
+    [string]$Secret = '',
+    [string]$ServiceBase = 'http://127.0.0.1:25090',
+    [string]$RemoteEntry = '',
+    [switch]$SkipDeclare = $false
+)
+
+$ErrorActionPreference = 'Stop'
+$ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+
+$EffectiveApiKey = if ($ApiKey) { $ApiKey } else { $env:SUBSCRIPTION_API_KEY }
+$EffectiveSecret = if ($Secret) { $Secret } else { $env:SUBSCRIPTION_SECRET }
+
+Write-Host ''
+Write-Host '===== VENOM REBUILD START =====' -ForegroundColor Cyan
+
+# 1. Build the remote entry bundle
+Write-Host '[1/2] npm run build (venom_ui)...' -ForegroundColor Yellow
+Push-Location (Join-Path $ScriptDir 'venom_ui')
+try {
+    npm run build
+    if ($LASTEXITCODE -ne 0) { throw "venom_ui build failed (exit $LASTEXITCODE)" }
+} finally {
+    Pop-Location
+}
+Write-Host '  build OK -> venom_ui/dist/venom-entry.js' -ForegroundColor Green
+
+if ($SkipDeclare) {
+    Write-Host '  declare skipped (-SkipDeclare): master cache NOT purged' -ForegroundColor Yellow
+    Write-Host '===== VENOM REBUILD DONE (build only) =====' -ForegroundColor Cyan
+    return
+}
+
+# 2. Redeclare -> master re-registers the entry and purges this product's asset cache
+if (-not $EffectiveApiKey -or -not $EffectiveSecret) {
+    Write-Host '  missing credentials: pass -ApiKey/-Secret or set SUBSCRIPTION_API_KEY / SUBSCRIPTION_SECRET' -ForegroundColor Yellow
+    Write-Host '  declare skipped -> master keeps serving the cached (old) bundle until TTL expires' -ForegroundColor Yellow
+    Write-Host '===== VENOM REBUILD DONE (build only) =====' -ForegroundColor Cyan
+    return
+}
+
+Write-Host '[2/2] declare custom page (purges master cache)...' -ForegroundColor Yellow
+$payload = @{ ApiKey = $EffectiveApiKey; Secret = $EffectiveSecret }
+if ($RemoteEntry) { $payload.RemoteEntry = $RemoteEntry }
+$json = $payload | ConvertTo-Json -Compress
+try {
+    $resp = Invoke-RestMethod -Method Post -Uri "$ServiceBase/api/sub/declare-page/" `
+        -ContentType 'application/json' -Body $json -TimeoutSec 60
+    Write-Host ('  declare OK -> ' + ($resp | ConvertTo-Json -Compress -Depth 6)) -ForegroundColor Green
+} catch {
+    throw "declare failed: $_ (is GVSDServiceServer running on $ServiceBase ?)"
+}
+
+Write-Host ''
+Write-Host '===== VENOM REBUILD DONE =====' -ForegroundColor Cyan
+Write-Host 'Hard-refresh the browser (Ctrl+F5) to pick up the new bundle.' -ForegroundColor Cyan