diff --git a/src/main/java/com/ffii/fpsms/config/security/SecurityConfig.java b/src/main/java/com/ffii/fpsms/config/security/SecurityConfig.java
index 16550992..6d9c1478 100644
--- a/src/main/java/com/ffii/fpsms/config/security/SecurityConfig.java
+++ b/src/main/java/com/ffii/fpsms/config/security/SecurityConfig.java
@@ -148,6 +148,11 @@ public class SecurityConfig {
.hasAnyAuthority("ADMIN", "TRUCK_LANE", "TESTING")
.requestMatchers("/truckLaneSchedule/**")
.hasAnyAuthority("ADMIN", "TRUCK_LANE", "TESTING")
+ /* 員工發貨績效 (/chart/delivery): PERFORMANCE (績效) */
+ .requestMatchers(HttpMethod.GET, "/chart/staff-delivery-performance")
+ .hasAuthority("PERFORMANCE")
+ .requestMatchers(HttpMethod.GET, "/chart/staff-delivery-performance-handlers")
+ .hasAuthority("PERFORMANCE")
.anyRequest().authenticated())
.httpBasic(httpBasic -> httpBasic.authenticationEntryPoint(
(request, response, authException) -> sendUnauthorizedJson(response, "Unauthorized", "UNAUTHORIZED")))
diff --git a/src/main/resources/db/changelog/changes/20261004_performance_authority/01_add_performance_authority.sql b/src/main/resources/db/changelog/changes/20261004_performance_authority/01_add_performance_authority.sql
new file mode 100644
index 00000000..0f803056
--- /dev/null
+++ b/src/main/resources/db/changelog/changes/20261004_performance_authority/01_add_performance_authority.sql
@@ -0,0 +1,19 @@
+--liquibase formatted sql
+
+--changeset fpsms:add_performance_authority
+--preconditions onFail:MARK_RAN
+--precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM authority WHERE authority = 'PERFORMANCE'
+--comment: Staff delivery performance on /chart/delivery requires PERFORMANCE (績效)
+INSERT IGNORE INTO `authority` (`authority`, `name`, `module`, `description`)
+VALUES ('PERFORMANCE', '績效', 'CHART', 'Allow viewing staff delivery performance on /chart/delivery');
+
+--changeset fpsms:grant_performance_authority_to_2fi
+--preconditions onFail:MARK_RAN
+--precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM user_authority ua JOIN `user` u ON u.id = ua.userId JOIN authority a ON a.id = ua.authId WHERE u.username = '2fi' AND a.authority = 'PERFORMANCE'
+--comment: Default grant 績效 to user 2fi
+INSERT IGNORE INTO `user_authority` (`userId`, `authId`)
+SELECT u.id, a.id
+FROM `user` u
+JOIN `authority` a ON a.authority = 'PERFORMANCE'
+WHERE u.username = '2fi'
+ AND u.deleted = 0;
diff --git a/src/main/resources/qrCodeLabel/poItemPDF_v4.jrxml b/src/main/resources/qrCodeLabel/poItemPDF_v4.jrxml
index 7125b95a..31e29cd3 100644
--- a/src/main/resources/qrCodeLabel/poItemPDF_v4.jrxml
+++ b/src/main/resources/qrCodeLabel/poItemPDF_v4.jrxml
@@ -66,28 +66,28 @@
-
+
-
+
-
+
-
+
-
+
@@ -96,14 +96,14 @@
-
+
-
+
@@ -114,42 +114,42 @@
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+