diff --git a/packages/libs/lib-server/src/system/settings/service/models.ts b/packages/libs/lib-server/src/system/settings/service/models.ts
index c8daffbaf..d81e897ff 100644
--- a/packages/libs/lib-server/src/system/settings/service/models.ts
+++ b/packages/libs/lib-server/src/system/settings/service/models.ts
@@ -253,6 +253,14 @@ export class SysSuiteSetting extends BaseSettings {
   intro?: string;
 }
 
+export class SysAutoFixSetting extends BaseSettings {
+  static __title__ = '自动修复记录';
+  static __key__ = 'sys.auto.fix';
+  static __access__ = 'private';
+
+  fixed: Record<string, boolean> = {};
+}
+
 
 export type SiteHidden = {
   enabled: boolean;
diff --git a/packages/ui/certd-server/src/modules/auto/fix/auto-fix.test.ts b/packages/ui/certd-server/src/modules/auto/fix/auto-fix.test.ts
index f2ab27e93..c0760cfbb 100644
--- a/packages/ui/certd-server/src/modules/auto/fix/auto-fix.test.ts
+++ b/packages/ui/certd-server/src/modules/auto/fix/auto-fix.test.ts
@@ -2,9 +2,24 @@ import assert from "assert";
 import { AutoFix } from "./auto-fix.js";
 
 describe("AutoFix", () => {
-  it("runs fix tasks in order", async () => {
+  it("runs unfinished fix tasks in order and marks them fixed", async () => {
     const calls: string[] = [];
+    let savedSetting: any;
     const autoFix = new AutoFix();
+    autoFix.sysSettingsService = {
+      async getSetting() {
+        return {
+          fixed: {
+            "oauth-subtype-bound-type": true,
+          },
+        };
+      },
+      async saveSetting(setting: any) {
+        savedSetting = {
+          fixed: { ...setting.fixed },
+        };
+      },
+    } as any;
     autoFix.googleCommonEabAccountKeyFix = {
       async init() {
         calls.push("google");
@@ -28,6 +43,26 @@ describe("AutoFix", () => {
 
     await autoFix.init();
 
-    assert.deepEqual(calls, ["google", "oauth", "cert", "suite"]);
+    assert.deepEqual(calls, ["google", "cert", "suite"]);
+    assert.equal(savedSetting.fixed["google-common-eab-account-key"], true);
+    assert.equal(savedSetting.fixed["oauth-subtype-bound-type"], true);
+    assert.equal(savedSetting.fixed["cert-info-wildcard-domain-count"], true);
+    assert.equal(savedSetting.fixed["suite-content-wildcard-domain-count"], true);
+  });
+
+  it("initializes missing fixed map", async () => {
+    const autoFix = new AutoFix();
+    autoFix.sysSettingsService = {
+      async getSetting() {
+        return {};
+      },
+      async saveSetting() {},
+    } as any;
+    autoFix.googleCommonEabAccountKeyFix = { async init() {} } as any;
+    autoFix.oauthSubtypeBoundTypeFix = { async init() {} } as any;
+    autoFix.certInfoWildcardDomainCountFix = { async init() {} } as any;
+    autoFix.suiteContentWildcardDomainCountFix = { async init() {} } as any;
+
+    await autoFix.init();
   });
 });
diff --git a/packages/ui/certd-server/src/modules/auto/fix/auto-fix.ts b/packages/ui/certd-server/src/modules/auto/fix/auto-fix.ts
index e007a6a0e..9e981461a 100644
--- a/packages/ui/certd-server/src/modules/auto/fix/auto-fix.ts
+++ b/packages/ui/certd-server/src/modules/auto/fix/auto-fix.ts
@@ -1,12 +1,23 @@
 import { Inject, Provide, Scope, ScopeEnum } from "@midwayjs/core";
+import { SysAutoFixSetting, SysSettingsService } from "@certd/lib-server";
 import { GoogleCommonEabAccountKeyFix } from "./google-common-eab-account-key-fix.js";
 import { OauthSubtypeBoundTypeFix } from "./oauth-subtype-bound-type-fix.js";
 import { CertInfoWildcardDomainCountFix } from "./cert-info-wildcard-domain-count-fix.js";
 import { SuiteContentWildcardDomainCountFix } from "./suite-content-wildcard-domain-count-fix.js";
 
+type AutoFixTask = {
+  key: string;
+  fix: {
+    init(): Promise<void>;
+  };
+};
+
 @Provide()
 @Scope(ScopeEnum.Request, { allowDowngrade: true })
 export class AutoFix {
+  @Inject()
+  sysSettingsService: SysSettingsService;
+
   @Inject()
   googleCommonEabAccountKeyFix: GoogleCommonEabAccountKeyFix;
 
@@ -20,9 +31,34 @@ export class AutoFix {
   suiteContentWildcardDomainCountFix: SuiteContentWildcardDomainCountFix;
 
   async init() {
-    await this.googleCommonEabAccountKeyFix.init();
-    await this.oauthSubtypeBoundTypeFix.init();
-    await this.certInfoWildcardDomainCountFix.init();
-    await this.suiteContentWildcardDomainCountFix.init();
+    const setting = await this.sysSettingsService.getSetting<SysAutoFixSetting>(SysAutoFixSetting);
+    setting.fixed = setting.fixed || {};
+    const tasks: AutoFixTask[] = [
+      {
+        key: "google-common-eab-account-key",
+        fix: this.googleCommonEabAccountKeyFix,
+      },
+      {
+        key: "oauth-subtype-bound-type",
+        fix: this.oauthSubtypeBoundTypeFix,
+      },
+      {
+        key: "cert-info-wildcard-domain-count",
+        fix: this.certInfoWildcardDomainCountFix,
+      },
+      {
+        key: "suite-content-wildcard-domain-count",
+        fix: this.suiteContentWildcardDomainCountFix,
+      },
+    ];
+
+    for (const task of tasks) {
+      if (setting.fixed?.[task.key]) {
+        continue;
+      }
+      await task.fix.init();
+      setting.fixed[task.key] = true;
+      await this.sysSettingsService.saveSetting(setting);
+    }
   }
 }