diff --git a/app/routers/erp_login.py b/app/routers/erp_login.py
index 4853088..9d29c94 100644
--- a/app/routers/erp_login.py
+++ b/app/routers/erp_login.py
@@ -45,7 +45,7 @@ def _require_session_id(session_id: int | None) -> int:
 
 
 def _scene(ticket: str, session_id: int) -> str:
-    return f"ticket={ticket}&session_id={session_id}"
+    return f"t={ticket}&s={session_id}"
 
 
 def _action_response(data: dict[str, Any]) -> ErpLoginActionResponse:
@@ -125,7 +125,7 @@ async def create_erp_login_qrcode(
     scene = _scene(payload.ticket, payload.session_id)
     try:
         qr_url = await create_miniapp_qrcode(
-            key=f"erp-login-{payload.ticket}",
+            key=f"erp-login-{payload.session_id}",
             page=ERP_LOGIN_PAGE,
             scene=scene,
             public_base_url=settings.public_base_url,
diff --git a/tests/test_erp_login.py b/tests/test_erp_login.py
index d204cc1..4ef8114 100644
--- a/tests/test_erp_login.py
+++ b/tests/test_erp_login.py
@@ -98,7 +98,7 @@ def test_qrcode_signed_request_uses_expected_miniapp_qrcode_contract(monkeypatch
 
     async def fake_create_miniapp_qrcode(**kwargs):
         calls.append(kwargs)
-        return "https://miniapp.example.com/uploads/erp-login-qrcodes/erp-login-ticket-abc.png"
+        return "https://miniapp.example.com/uploads/erp-login-qrcodes/erp-login-123.png"
 
     monkeypatch.setattr(erp_login, "create_miniapp_qrcode", fake_create_miniapp_qrcode)
     client = _client(monkeypatch)
@@ -112,18 +112,20 @@ def test_qrcode_signed_request_uses_expected_miniapp_qrcode_contract(monkeypatch
 
     assert response.status_code == 200
     assert response.json() == {
-        "qr_url": "https://miniapp.example.com/uploads/erp-login-qrcodes/erp-login-ticket-abc.png",
+        "qr_url": "https://miniapp.example.com/uploads/erp-login-qrcodes/erp-login-123.png",
         "page": "pages/erpLoginConfirm/erpLoginConfirm",
-        "scene": "ticket=ticket-abc&session_id=123",
+        "scene": "t=ticket-abc&s=123",
     }
+    assert "ticket-abc" not in calls[0]["key"]
     assert calls == [{
-        "key": "erp-login-ticket-abc",
+        "key": "erp-login-123",
         "page": "pages/erpLoginConfirm/erpLoginConfirm",
-        "scene": "ticket=ticket-abc&session_id=123",
+        "scene": "t=ticket-abc&s=123",
         "public_base_url": "https://miniapp.example.com",
         "directory": "erp-login-qrcodes",
         "label": "ERP扫码登录",
     }]
+    assert len(response.json()["scene"]) <= 32
 
 
 def test_qrcode_requires_session_id(monkeypatch):