diff --git a/src/App.vue b/src/App.vue
index 1ba91c8..9b5c46b 100644
--- a/src/App.vue
+++ b/src/App.vue
@@ -2,6 +2,7 @@
 import { onMounted, onUnmounted } from "vue";
 import { RouterView } from "vue-router";
 
+import { isDingTalkContainer } from "@/api/dingtalk";
 import router from "@/router";
 import { useAuthStore } from "@/stores/auth.store";
 
@@ -17,9 +18,20 @@ function handleAuthExpired() {
   }
 }
 
-onMounted(() =>
-  window.addEventListener("risk-auth-expired", handleAuthExpired),
-);
+onMounted(() => {
+  window.addEventListener("risk-auth-expired", handleAuthExpired);
+  // A persisted JWT only refreshes /auth/me and cannot update stale DingTalk
+  // department/name fields. Re-sync the organization identity once per page
+  // load when the app is opened inside DingTalk, without logging out on error.
+  if (
+    isDingTalkContainer() &&
+    auth.token &&
+    auth.user?.dingtalkId &&
+    !auth.user.dingtalkId.startsWith("local-")
+  ) {
+    void auth.dingTalkLogin(true);
+  }
+});
 onUnmounted(() =>
   window.removeEventListener("risk-auth-expired", handleAuthExpired),
 );
diff --git a/src/stores/auth.store.ts b/src/stores/auth.store.ts
index bda4f84..74ae593 100644
--- a/src/stores/auth.store.ts
+++ b/src/stores/auth.store.ts
@@ -61,7 +61,7 @@ export const useAuthStore = defineStore("auth", () => {
     }
   }
 
-  async function dingTalkLogin() {
+  async function dingTalkLogin(preserveSessionOnFailure = false) {
     loading.value = true;
     error.value = null;
     try {
@@ -69,7 +69,7 @@ export const useAuthStore = defineStore("auth", () => {
       saveToken(response.accessToken);
       user.value = response.user;
     } catch (reason) {
-      clear();
+      if (!preserveSessionOnFailure) clear();
       error.value = reason instanceof Error ? reason.message : "钉钉免登失败";
       throw reason;
     } finally {