diff --git a/controller/tts.go b/controller/tts.go
index ec5fa09..4b103f3 100644
--- a/controller/tts.go
+++ b/controller/tts.go
@@ -305,6 +305,7 @@ func HealthHandler(w http.ResponseWriter, r *http.Request) {
 		ConfigStatus: dto.ConfigStatusResponse{
 			AllRequiredVarsSet: allRequired,
 			ConfigError:        setting.TTSConfigErr != nil,
+			Error:              configErrorMessage(setting.TTSConfigErr),
 		},
 		Installed: mode == installer.ModeNormal,
 		Mode:      mode.String(),
@@ -312,6 +313,15 @@ func HealthHandler(w http.ResponseWriter, r *http.Request) {
 	json.NewEncoder(w).Encode(resp)
 }
 
+// configErrorMessage 把 setting.TTSConfigErr 安全地转成可对外暴露的字符串。
+// 仅在 normal 模式且有错时调用, error 为 nil 时返 "" (被 omitempty 跳过)。
+func configErrorMessage(err error) string {
+	if err == nil {
+		return ""
+	}
+	return err.Error()
+}
+
 var startTime time.Time
 
 func SetStartTime(t time.Time) { startTime = t }
diff --git a/dto/health.go b/dto/health.go
index cdc7bd4..8236887 100644
--- a/dto/health.go
+++ b/dto/health.go
@@ -18,6 +18,8 @@ type HealthResponse struct {
 }
 
 type ConfigStatusResponse struct {
-	AllRequiredVarsSet bool `json:"all_required_vars_set"`
-	ConfigError        bool `json:"config_error"`
+	AllRequiredVarsSet bool   `json:"all_required_vars_set"`
+	ConfigError        bool   `json:"config_error"`
+	// Error 仅在 ConfigError=true 时填充, 给出原始 error message, 方便运维 / curl 一眼看出原因
+	Error string `json:"error,omitempty"`
 }
diff --git a/main.go b/main.go
index 0120ac3..5612b46 100644
--- a/main.go
+++ b/main.go
@@ -15,6 +15,7 @@ import (
 	"github.com/volcano-tts/tts-api/middleware"
 	"github.com/volcano-tts/tts-api/router"
 	"github.com/volcano-tts/tts-api/setting"
+	"github.com/volcano-tts/tts-api/telemetry"
 )
 
 // ttsDBPath 返回数据库/lock 所在路径;空时落到当前目录的 tts.db。
@@ -58,9 +59,23 @@ func main() {
 
 	// 4) M3: 从 store 加载运行时 TTS 配置(替代原来的 env-based InitTTSConfig)
 	// 必须在 LogStartupSummary 之前,这样日志显示的是真实状态(API key 已从 DB 加载,不再读 env)
+	//
+	// 模式区分:
+	//   - setup 模式 + 失败 = 正常(还没装), 警告即可
+	//   - normal 模式 + 失败 = 致命(已装但配置坏), fail-fast 让 K8s/进程管理器拉起
 	if st != nil {
 		if err := setting.LoadRuntimeConfig(st); err != nil {
-			log.Printf("[main] TTS 运行时配置加载失败:%v", err)
+			mode := installer.GetMode()
+			modeName := "setup"
+			if mode == installer.ModeNormal {
+				modeName = "normal"
+			}
+			metrics.ConfigLoadFailures.Inc(telemetry.Labels{"mode": modeName})
+			if mode == installer.ModeNormal {
+				log.Printf("[main][FATAL] TTS 运行时配置加载失败 (normal mode, 服务无法启动): %v", err)
+				log.Fatalf("service cannot start in normal mode without valid config: %v", err)
+			}
+			log.Printf("[main][WARN] TTS 运行时配置加载失败 (setup mode, 需先 /setup): %v", err)
 		} else {
 			log.Printf("[main] TTS 运行时配置已加载(api_key=***, speaker=%s, resource=%s, format=%s)",
 				setting.TTSOptions.Speaker, setting.TTSOptions.ResourceID, setting.TTSOptions.Format)
diff --git a/metrics/metrics.go b/metrics/metrics.go
index 7fbd623..35828cb 100644
--- a/metrics/metrics.go
+++ b/metrics/metrics.go
@@ -34,6 +34,9 @@ var (
 	ConcurrencyRejected *telemetry.Counter
 	RateLimitRejected   *telemetry.Counter
 	AuthFailed          *telemetry.Counter
+
+	// 启动期配置加载失败(仅 normal 模式可能触发,触发后服务 fail-fast)
+	ConfigLoadFailures *telemetry.Counter
 )
 
 // Init 初始化所有指标。在 main 启动期调用一次。
@@ -107,6 +110,11 @@ func Init() {
 		"tts_auth_failed_total",
 		"Requests rejected due to invalid/missing API key.",
 	)
+	ConfigLoadFailures = m.NewCounter(
+		"tts_config_load_failures_total",
+		"TTS runtime config load failures during startup. labeled by mode (normal/setup).",
+		"mode",
+	)
 }
 
 // AdapterRecorder 把 telemetry 指标适配为 volcano.MetricsRecorder。