diff --git a/config/config.go b/config/config.go
index e0018fe..70edd90 100644
--- a/config/config.go
+++ b/config/config.go
@@ -51,6 +51,7 @@ var Config struct {
 	QQBotGroupID                 *int64   `env:"GROUP_ID"`
 	QQBotUserID                  *int64   `env:"USER_ID"`
 	QQBotUrl                     *string  `env:"QQ_BOT_URL"`
+	AdminOnlyTagIds              []int    `env:"ADMIN_ONLY_TAG_IDS"`
 }
 
 var DynamicConfig struct {
diff --git a/models/tag.go b/models/tag.go
index 22e937b..474f445 100644
--- a/models/tag.go
+++ b/models/tag.go
@@ -1,12 +1,15 @@
 package models
 
 import (
-	"github.com/gofiber/fiber/v2"
+	"fmt"
 	"strings"
 	"sync"
 	"time"
+	"treehole_next/config"
 	"treehole_next/utils/sensitive"
 
+	"github.com/gofiber/fiber/v2"
+
 	"github.com/opentreehole/go-common"
 	"github.com/rs/zerolog/log"
 	"golang.org/x/exp/slices"
@@ -65,15 +68,20 @@ func FindOrCreateTags(tx *gorm.DB, user *User, names []string) (Tags, error) {
 		return nil, err
 	}
 
-	existTagName := make([]string, 0)
+	existTagNames := make([]string, 0)
 	for _, tag := range tags {
-		existTagName = append(existTagName, tag.Name)
+		existTagNames = append(existTagNames, tag.Name)
+		if slices.ContainsFunc(config.Config.AdminOnlyTagIds, func(i int) bool {
+			return i == tag.ID
+		}) {
+			return nil, common.Forbidden(fmt.Sprintf("标签 %s 为管理员专用标签", tag.Name))
+		}
 	}
 
 	newTags := make(Tags, 0)
 	for _, name := range names {
 		name = strings.TrimSpace(name)
-		if !slices.ContainsFunc(existTagName, func(s string) bool {
+		if !slices.ContainsFunc(existTagNames, func(s string) bool {
 			return strings.EqualFold(s, name)
 		}) {
 			newTags = append(newTags, &Tag{Name: name})