diff --git a/atsf_agent/cmd/agent/main.go b/atsf_agent/cmd/agent/main.go
index 51bcd173..a3627119 100644
--- a/atsf_agent/cmd/agent/main.go
+++ b/atsf_agent/cmd/agent/main.go
@@ -39,7 +39,7 @@ func main() {
 	)
 	log.Printf("agent config loaded: server=%s node=%s ip=%s heartbeat_interval=%s sync_interval=%s route_config=%s cert_dir=%s", cfg.ServerURL, cfg.NodeName, cfg.NodeIP, cfg.HeartbeatInterval, cfg.SyncInterval, cfg.RouteConfigPath, cfg.CertDir)
 
-	client := httpclient.New(cfg.ServerURL, cfg.AgentToken, cfg.RequestTimeout.Duration())
+	client := httpclient.New(cfg.ServerURL, cfg.InitialAuthToken(), cfg.RequestTimeout.Duration())
 	stateStore := state.NewStore(cfg.StatePath)
 	runner := &agent.Runner{
 		Config:           cfg,
diff --git a/atsf_agent/internal/config/config.go b/atsf_agent/internal/config/config.go
index 315faa7a..509fb954 100644
--- a/atsf_agent/internal/config/config.go
+++ b/atsf_agent/internal/config/config.go
@@ -157,6 +157,16 @@ func validate(cfg *Config) error {
 	return nil
 }
 
+func (cfg *Config) InitialAuthToken() string {
+	if cfg == nil {
+		return ""
+	}
+	if token := strings.TrimSpace(cfg.AgentToken); token != "" {
+		return token
+	}
+	return strings.TrimSpace(cfg.DiscoveryToken)
+}
+
 func (cfg *Config) Save() error {
 	if cfg == nil {
 		return errors.New("config 不能为空")
diff --git a/atsf_agent/internal/config/config_test.go b/atsf_agent/internal/config/config_test.go
index 780be26c..7bbc5304 100644
--- a/atsf_agent/internal/config/config_test.go
+++ b/atsf_agent/internal/config/config_test.go
@@ -197,3 +197,46 @@ func TestSavePersistsMillisecondsAndOmitsRuntimeVersions(t *testing.T) {
 		t.Fatalf("unexpected request timeout: %#v", decoded["request_timeout"])
 	}
 }
+
+func TestInitialAuthToken(t *testing.T) {
+	tests := []struct {
+		name           string
+		agentToken     string
+		discoveryToken string
+		expected       string
+	}{
+		{
+			name:           "prefer agent token",
+			agentToken:     "agent-token",
+			discoveryToken: "discovery-token",
+			expected:       "agent-token",
+		},
+		{
+			name:           "fallback to discovery token",
+			agentToken:     "   ",
+			discoveryToken: "discovery-token",
+			expected:       "discovery-token",
+		},
+		{
+			name:           "nil config returns empty string",
+			agentToken:     "",
+			discoveryToken: "",
+			expected:       "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var cfg *Config
+			if tt.name != "nil config returns empty string" {
+				cfg = &Config{
+					AgentToken:     tt.agentToken,
+					DiscoveryToken: tt.discoveryToken,
+				}
+			}
+			if token := cfg.InitialAuthToken(); token != tt.expected {
+				t.Fatalf("unexpected initial auth token: %q", token)
+			}
+		})
+	}
+}