diff --git a/iam/src/main/java/com/baiyue/iam/service/SecurityEventOutboxService.java b/iam/src/main/java/com/baiyue/iam/service/SecurityEventOutboxService.java
index d9372a2e2..fcc158420 100644
--- a/iam/src/main/java/com/baiyue/iam/service/SecurityEventOutboxService.java
+++ b/iam/src/main/java/com/baiyue/iam/service/SecurityEventOutboxService.java
@@ -53,9 +53,10 @@ public class SecurityEventOutboxService {
                        long aggregateVersion, Object value) {
         JsonNode payload = objectMapper.valueToTree(value);
         String hash = EventPayloadHash.sha256(EventPayloadCanonicalizer.canonicalize(payload));
+        String flowId = EventIdentifiers.newUuid();
         EventEnvelope envelope = new EventEnvelope(EventIdentifiers.newUuid(), type, IamSecurityEventsV1.VERSION,
             Instant.now(), RegionCode.CN, RegionCode.OVERSEAS, String.valueOf(tenantId), aggregateType,
-            aggregateId, aggregateVersion, null, EventIdentifiers.newUuid(), null, null, payload, hash).requireValid();
+            aggregateId, aggregateVersion, null, flowId, flowId, null, payload, hash).requireValid();
         try {
             jdbc.update("INSERT INTO iam_security_event_outbox(event_id,event_type,aggregate_type,aggregate_id,payload_json) "
                     + "VALUES (?,?,?,?,CAST(? AS JSON))", envelope.eventId(), type, aggregateType, aggregateId,
diff --git a/iam/src/test/java/com/baiyue/iam/service/SecurityEventOutboxServiceTest.java b/iam/src/test/java/com/baiyue/iam/service/SecurityEventOutboxServiceTest.java
new file mode 100644
index 000000000..432587f3f
--- /dev/null
+++ b/iam/src/test/java/com/baiyue/iam/service/SecurityEventOutboxServiceTest.java
@@ -0,0 +1,46 @@
+package com.baiyue.iam.service;
+
+import com.baiyue.common.event.EventEnvelope;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class SecurityEventOutboxServiceTest {
+    @Mock JdbcTemplate jdbc;
+    private final ObjectMapper objectMapper = new ObjectMapper().findAndRegisterModules();
+    private SecurityEventOutboxService service;
+
+    @BeforeEach
+    void setUp() {
+        service = new SecurityEventOutboxService();
+        ReflectionTestUtils.setField(service, "jdbc", jdbc);
+        ReflectionTestUtils.setField(service, "objectMapper", objectMapper);
+    }
+
+    @Test
+    void userStatusWritesAValidEnvelopeWithCorrelationId() throws Exception {
+        when(jdbc.queryForObject(anyString(), eq(Long.class), any())).thenReturn(1L);
+
+        service.userStatus(101L, 0L, "PLATFORM", "DISABLED");
+
+        ArgumentCaptor<Object[]> parameters = ArgumentCaptor.forClass(Object[].class);
+        verify(jdbc).update(eq("INSERT INTO iam_security_event_outbox(event_id,event_type,aggregate_type,aggregate_id,payload_json) "
+            + "VALUES (?,?,?,?,CAST(? AS JSON))"), parameters.capture());
+        EventEnvelope envelope = objectMapper.readValue(String.valueOf(parameters.getValue()[4]), EventEnvelope.class);
+        assertThat(envelope.requireValid().correlationId()).isNotBlank().isEqualTo(envelope.traceId());
+    }
+}