diff --git a/clash/config.yaml b/clash/config.yaml
index 691b09f..bb21561 100644
--- a/clash/config.yaml
+++ b/clash/config.yaml
@@ -481,18 +481,7 @@ rules:
   - PROCESS-NAME,tailscaled,DIRECT
   - RULE-SET,tailscale-custom,Tailscale
 
-  # ─── 广告拦截 ───
-  - RULE-SET,reject,REJECT
-
-  # ─── 直连 (局域网、国内) ───
-  - RULE-SET,private,DIRECT
-  - RULE-SET,lancidr,DIRECT
-  - RULE-SET,cncidr,DIRECT
-  - RULE-SET,direct,DIRECT
-  - RULE-SET,direct-custom,DIRECT
-
-  # ─── Google 全家桶 (IP一致性！登录要求所有Google域名走同一节点) ───
-  # 必须在 AI 规则之前，否则 aistudio/gemini 走 AI 组而 accounts 走 Google 组 → 登录失败
+  # ─── Google 全家桶 (必须在 reject 之前！reject 可能误拦 OAuth 需要的域名) ───
   - DOMAIN-KEYWORD,google,Google
   - DOMAIN-SUFFIX,googleapis.com,Google
   - DOMAIN-SUFFIX,gstatic.com,Google
@@ -503,6 +492,16 @@ rules:
   - DOMAIN-SUFFIX,ytimg.com,Google
   - DOMAIN-SUFFIX,youtu.be,Google
 
+  # ─── 广告拦截 ───
+  - RULE-SET,reject,REJECT
+
+  # ─── 直连 (局域网、国内) ───
+  - RULE-SET,private,DIRECT
+  - RULE-SET,lancidr,DIRECT
+  - RULE-SET,cncidr,DIRECT
+  - RULE-SET,direct,DIRECT
+  - RULE-SET,direct-custom,DIRECT
+
   # ─── AI 服务 (非Google的AI：OpenAI/Claude/Copilot等) ───
   - RULE-SET,ai-services,AI
   - RULE-SET,openai,AI