diff --git a/app/Http/Controllers/Admin/StaffCardController.php b/app/Http/Controllers/Admin/StaffCardController.php
index 8cbf835..3cf4542 100644
--- a/app/Http/Controllers/Admin/StaffCardController.php
+++ b/app/Http/Controllers/Admin/StaffCardController.php
@@ -110,6 +110,15 @@ class StaffCardController extends Controller
 
         $validated['status'] = $request->get('status', $staffCard->status);
 
+        // 寫入安全：company_id 不得由前端任意決定或被洗成 null
+        // - 非系統管理員：強制綁定自身公司 (租戶隔離)
+        // - 系統管理員：若未帶入公司，保留原本歸屬，避免變成無公司歸屬的孤兒卡 (機台將查無此卡)
+        if (!auth()->user()->isSystemAdmin()) {
+            $validated['company_id'] = auth()->user()->company_id;
+        } elseif (empty($validated['company_id'])) {
+            $validated['company_id'] = $staffCard->company_id;
+        }
+
         $staffCard->update($validated);
 
         if ($request->ajax()) {
diff --git a/resources/views/admin/data-config/staff-cards/index.blade.php b/resources/views/admin/data-config/staff-cards/index.blade.php
index 9f858c0..d8d5a0d 100644
--- a/resources/views/admin/data-config/staff-cards/index.blade.php
+++ b/resources/views/admin/data-config/staff-cards/index.blade.php
@@ -448,7 +448,11 @@
                 this.$nextTick(() => {
                     const select = HSSelect.getInstance('#modal-company-id', true);
                     if (select) {
-                        select.setValue(this.staffFormFields.company_id || ' ');
+                        // Preline 的 option value 為字串，company_id 為數字時嚴格比對會失配導致回填失敗，
+                        // 故統一轉成字串；空值則以 ' ' 對應 placeholder 選項
+                        const cid = this.staffFormFields.company_id;
+                        const valStr = (cid !== undefined && cid !== null && cid.toString().trim() !== '') ? cid.toString() : ' ';
+                        select.setValue(valStr);
                     }
                 });
             },