diff --git a/internal/domain/workflow.go b/internal/domain/workflow.go
index 1229da47..2766018d 100644
--- a/internal/domain/workflow.go
+++ b/internal/domain/workflow.go
@@ -64,6 +64,7 @@ type WorkflowNode struct {
 type WorkflowNodeConfigForApply struct {
 	Domains               string         `json:"domains"`               // 域名列表，以半角逗号分隔
 	ContactEmail          string         `json:"contactEmail"`          // 联系邮箱
+	ChallengeType         string         `json:"challengeType"`         // TODO: 验证方式。目前仅支持 dns-01
 	Provider              string         `json:"provider"`              // DNS 提供商
 	ProviderAccessId      string         `json:"providerAccessId"`      // DNS 提供商授权记录 ID
 	ProviderConfig        map[string]any `json:"providerConfig"`        // DNS 提供商额外配置
diff --git a/ui/src/components/workflow/node/ApplyNode.tsx b/ui/src/components/workflow/node/ApplyNode.tsx
index 6e090616..74e84ddb 100644
--- a/ui/src/components/workflow/node/ApplyNode.tsx
+++ b/ui/src/components/workflow/node/ApplyNode.tsx
@@ -56,6 +56,7 @@ const ApplyNode = ({ node, disabled }: ApplyNodeProps) => {
       const newNode = produce(node, (draft) => {
         draft.config = {
           ...newValues,
+          challengeType: newValues.challengeType || "dns-01", // 默认使用 DNS-01 认证
         };
         draft.validated = true;
       });
diff --git a/ui/src/components/workflow/node/ApplyNodeConfigForm.tsx b/ui/src/components/workflow/node/ApplyNodeConfigForm.tsx
index 1792163e..bfb5f420 100644
--- a/ui/src/components/workflow/node/ApplyNodeConfigForm.tsx
+++ b/ui/src/components/workflow/node/ApplyNodeConfigForm.tsx
@@ -56,6 +56,7 @@ const MULTIPLE_INPUT_DELIMITER = ";";
 
 const initFormModel = (): ApplyNodeConfigFormFieldValues => {
   return {
+    challengeType: "dns-01",
     keyAlgorithm: "RSA2048",
     skipBeforeExpiryDays: 20,
   };
@@ -74,6 +75,7 @@ const ApplyNodeConfigForm = forwardRef<ApplyNodeConfigFormInstance, ApplyNodeCon
           .every((e) => validDomainName(e, { allowWildcard: true }));
       }, t("common.errmsg.domain_invalid")),
       contactEmail: z.string({ message: t("workflow_node.apply.form.contact_email.placeholder") }).email(t("common.errmsg.email_invalid")),
+      challengeType: z.string().nullish(),
       provider: z.string({ message: t("workflow_node.apply.form.provider.placeholder") }).nonempty(t("workflow_node.apply.form.provider.placeholder")),
       providerAccessId: z
         .string({ message: t("workflow_node.apply.form.provider_access.placeholder") })
@@ -235,6 +237,16 @@ const ApplyNodeConfigForm = forwardRef<ApplyNodeConfigFormInstance, ApplyNodeCon
             <EmailInput placeholder={t("workflow_node.apply.form.contact_email.placeholder")} />
           </Form.Item>
 
+          <Form.Item name="challengeType" label={t("workflow_node.apply.form.challenge_type.label")} rules={[formRule]} hidden>
+            <Select
+              options={["DNS-01"].map((e) => ({
+                label: e,
+                value: e.toLowerCase(),
+              }))}
+              placeholder={t("workflow_node.apply.form.challenge_type.placeholder")}
+            />
+          </Form.Item>
+
           <Form.Item name="provider" label={t("workflow_node.apply.form.provider.label")} hidden rules={[formRule]}>
             <ApplyDNSProviderSelect
               allowClear
diff --git a/ui/src/domain/workflow.ts b/ui/src/domain/workflow.ts
index 82625c21..7ff3a4f7 100644
--- a/ui/src/domain/workflow.ts
+++ b/ui/src/domain/workflow.ts
@@ -122,6 +122,7 @@ export type WorkflowNodeConfigForStart = {
 export type WorkflowNodeConfigForApply = {
   domains: string;
   contactEmail: string;
+  challengeType: string;
   provider: string;
   providerAccessId: string;
   providerConfig?: Record<string, unknown>;