diff --git a/server-rs/crates/spacetime-module/src/runtime/active/profile.rs b/server-rs/crates/spacetime-module/src/runtime/active/profile.rs
index 0bffc6c79..68b4f0586 100644
--- a/server-rs/crates/spacetime-module/src/runtime/active/profile.rs
+++ b/server-rs/crates/spacetime-module/src/runtime/active/profile.rs
@@ -8814,7 +8814,9 @@ fn upsert_profile_membership_plan_record(
     .map_err(|error| error.to_string())?;
     ensure_default_profile_membership_plan(ctx);
 
-    let updated_at = Timestamp::from_micros_since_unix_epoch(validated.updated_at_micros);
+    // 审计时间以 SpacetimeDB 事务时间为准：入参 `updated_at_micros` 不再被信任，
+    // 因为 procedure 可被持有 writer 身份者直接调用，客户端时钟可以伪造。
+    let updated_at = ctx.timestamp;
     let existing = ctx
         .db
         .profile_membership_plan()