diff --git a/backend/src/main/java/com/example/erp/module/usr/controller/UserController.java b/backend/src/main/java/com/example/erp/module/usr/controller/UserController.java
index faa9d2e..19260be 100644
--- a/backend/src/main/java/com/example/erp/module/usr/controller/UserController.java
+++ b/backend/src/main/java/com/example/erp/module/usr/controller/UserController.java
@@ -5,11 +5,13 @@ import com.example.erp.common.vo.PageVO;
 import com.example.erp.config.UserPrincipal;
 import com.example.erp.module.usr.dto.UserCreateReqDTO;
 import com.example.erp.module.usr.dto.UserListQueryDTO;
+import com.example.erp.module.usr.dto.UserUpdateReqDTO;
 import com.example.erp.module.usr.service.UserService;
 import com.example.erp.module.usr.vo.PermissionGroupVO;
 import com.example.erp.module.usr.vo.StaffVO;
 import com.example.erp.module.usr.vo.UserCreateRespVO;
 import com.example.erp.module.usr.vo.UserListItemVO;
+import com.example.erp.module.usr.vo.UserUpdateRespVO;
 import jakarta.validation.Valid;
 import lombok.RequiredArgsConstructor;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
@@ -49,6 +51,15 @@ public class UserController {
         return Result.ok(userService.getUserList(q, principal.brandId()));
     }
 
+    // REQ-USR-002: 修改用户
+    @PutMapping("/users/{userId}")
+    public Result<UserUpdateRespVO> updateUser(
+            @PathVariable String userId,
+            @Valid @RequestBody UserUpdateReqDTO req,
+            @AuthenticationPrincipal UserPrincipal principal) {
+        return Result.ok(userService.updateUser(userId, req, principal));
+    }
+
     @GetMapping("/users/staffs")
     public Result<List<StaffVO>> getStaffs(@AuthenticationPrincipal UserPrincipal principal) {
         return Result.ok(userService.getStaffs(principal.brandId()));
diff --git a/backend/src/test/java/com/example/erp/module/usr/UserControllerTest.java b/backend/src/test/java/com/example/erp/module/usr/UserControllerTest.java
index 8b66013..5e4a91f 100644
--- a/backend/src/test/java/com/example/erp/module/usr/UserControllerTest.java
+++ b/backend/src/test/java/com/example/erp/module/usr/UserControllerTest.java
@@ -9,8 +9,10 @@ import com.example.erp.module.usr.controller.UserController;
 import com.example.erp.module.usr.service.UserService;
 import com.example.erp.common.vo.PageVO;
 import com.example.erp.module.usr.dto.UserListQueryDTO;
+import com.example.erp.module.usr.dto.UserUpdateReqDTO;
 import com.example.erp.module.usr.vo.UserCreateRespVO;
 import com.example.erp.module.usr.vo.UserListItemVO;
+import com.example.erp.module.usr.vo.UserUpdateRespVO;
 import com.example.erp.module.usr.vo.StaffVO;
 import com.example.erp.module.usr.vo.PermissionGroupVO;
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -128,6 +130,36 @@ class UserControllerTest {
     }
 
     @Test
+    void updateUser_withToken_returns200() throws Exception {
+        UserUpdateRespVO resp = new UserUpdateRespVO();
+        resp.setUserId("u-target");
+        resp.setUsername("alice");
+        resp.setUpdatedAt(java.time.LocalDateTime.now());
+        when(userService.updateUser(anyString(), any(UserUpdateReqDTO.class), any())).thenReturn(resp);
+
+        UserUpdateReqDTO body = new UserUpdateReqDTO();
+        body.setUserType("普通用户");
+        body.setLanguage("中文");
+        body.setPermGroupIds(List.of());
+
+        mockMvc.perform(put("/api/usr/users/u-target").with(superAdmin())
+                        .contentType(org.springframework.http.MediaType.APPLICATION_JSON)
+                        .content(objectMapper.writeValueAsString(body)))
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.code").value(200))
+                .andExpect(jsonPath("$.data.userId").value("u-target"))
+                .andExpect(jsonPath("$.data.username").value("alice"));
+    }
+
+    @Test
+    void updateUser_noAuth_returns401() throws Exception {
+        mockMvc.perform(put("/api/usr/users/u-target")
+                        .contentType(org.springframework.http.MediaType.APPLICATION_JSON)
+                        .content("{}"))
+                .andExpect(status().isUnauthorized());
+    }
+
+    @Test
     void getPermissionGroups_returns200() throws Exception {
         PermissionGroupVO g = new PermissionGroupVO();
         g.setSId("g1");