diff --git a/app/routers/erp_login.py b/app/routers/erp_login.py
index 8c15146..4853088 100644
--- a/app/routers/erp_login.py
+++ b/app/routers/erp_login.py
@@ -149,6 +149,10 @@ async def preview_erp_login_session(
         f"/api/auth/qr-login/sessions/{session_id}/preview",
         params={"ticket": ticket},
     )
+    await _post_erp_json(
+        f"/api/auth/qr-login/sessions/{session_id}/scanned",
+        {"ticket": ticket},
+    )
     return ErpLoginPreviewResponse(**data)
 
 
diff --git a/tests/test_erp_login.py b/tests/test_erp_login.py
index b50a11b..d204cc1 100644
--- a/tests/test_erp_login.py
+++ b/tests/test_erp_login.py
@@ -158,6 +158,49 @@ def test_preview_requires_session_id(monkeypatch):
     assert response.json()["detail"] == "缺少ERP扫码登录会话ID"
 
 
+def test_preview_marks_erp_session_scanned(monkeypatch):
+    from app.routers import erp_login
+
+    original_async_client = httpx.AsyncClient
+    calls = []
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        calls.append((request.method, request.url.path, request.content))
+        if request.method == "GET":
+            assert request.url.path == "/api/auth/qr-login/sessions/123/preview"
+            assert request.url.params["ticket"] == "ticket-abc"
+            return httpx.Response(
+                200,
+                json={
+                    "session_id": 123,
+                    "system_name": "嘉恒智能五金 ERP",
+                    "started_at": "2026-07-05T08:00:00",
+                    "expires_at": "2026-07-05T08:02:00",
+                    "request_ip_hint": "127.0.0.1",
+                    "user_agent_hint": "Chrome",
+                },
+            )
+        if request.method == "POST":
+            assert request.url.path == "/api/auth/qr-login/sessions/123/scanned"
+            assert json.loads(request.content.decode("utf-8")) == {"ticket": "ticket-abc"}
+            return httpx.Response(200, json={"status": "SCANNED"})
+        raise AssertionError(f"Unexpected request: {request.method} {request.url.path}")
+
+    transport = httpx.MockTransport(handler)
+
+    def fake_async_client(**kwargs):
+        _ = kwargs
+        return original_async_client(transport=transport)
+
+    monkeypatch.setattr(erp_login.httpx, "AsyncClient", fake_async_client)
+    client = _client(monkeypatch)
+
+    response = client.get("/api/erp-login/sessions/ticket-abc?session_id=123")
+
+    assert response.status_code == 200
+    assert [call[0] for call in calls] == ["GET", "POST"]
+
+
 def test_confirm_gets_phone_signs_erp_request_with_base_path_and_hides_auth_session(monkeypatch):
     from app.routers import erp_login