diff --git a/app/api/routers/rbac_operator.py b/app/api/routers/rbac_operator.py
index 005c176..197a8a4 100644
--- a/app/api/routers/rbac_operator.py
+++ b/app/api/routers/rbac_operator.py
@@ -321,6 +321,11 @@ async def create_task(
 ):
     fields = req.model_dump(exclude_none=True)
     fields["mode"] = _normalize_mode(fields.get("mode", "grab"))
+    # 空分类/空截止 → NULL：外键列可空，避免空字符串违反 tasks_ibfk_1 约束（500）
+    if not fields.get("category_id"):
+        fields["category_id"] = None
+    if not fields.get("deadline"):
+        fields["deadline"] = None
     if not fields.get("task_code"):
         fields["task_code"] = _gen_task_code()
     task = await db.tasks.create(fields)
@@ -346,7 +351,13 @@ async def update_task(
 ):
     if await db.tasks.get(task_id) is None:
         raise HTTPException(status_code=404, detail="Task not found")
-    task = await db.tasks.update(task_id, req.model_dump(exclude_none=True))
+    patch = req.model_dump(exclude_none=True)
+    # 空分类/空截止 → NULL（同 create 容错，避免外键 500）
+    if not patch.get("category_id"):
+        patch["category_id"] = None
+    if not patch.get("deadline"):
+        patch["deadline"] = None
+    task = await db.tasks.update(task_id, patch)
     await write_audit(db, action="task.update", resource="task", resource_id=task_id,
                 detail=(req.title or ""), user=actor, request=request)
     return task