diff --git a/clash/config.yaml b/clash/config.yaml
index bb21561..900c6cf 100644
--- a/clash/config.yaml
+++ b/clash/config.yaml
@@ -481,16 +481,23 @@ rules:
   - PROCESS-NAME,tailscaled,DIRECT
   - RULE-SET,tailscale-custom,Tailscale
 
-  # ─── Google 全家桶 (必须在 reject 之前！reject 可能误拦 OAuth 需要的域名) ───
+  # ─── Google 全家桶 (必须在 reject/direct 之前！) ───
+  # DOMAIN-KEYWORD,google 抓不到不含"google"的 Google 基础设施域名
+  # recaptcha.net / pki.goog 等被 Loyalsoldier direct 列表标记为直连 → 国内不可达
   - DOMAIN-KEYWORD,google,Google
   - DOMAIN-SUFFIX,googleapis.com,Google
   - DOMAIN-SUFFIX,gstatic.com,Google
   - DOMAIN-SUFFIX,googleusercontent.com,Google
   - DOMAIN-SUFFIX,gvt1.com,Google
+  - DOMAIN-SUFFIX,gvt2.com,Google
   - DOMAIN-SUFFIX,ggpht.com,Google
   - DOMAIN-SUFFIX,youtube.com,Google
   - DOMAIN-SUFFIX,ytimg.com,Google
   - DOMAIN-SUFFIX,youtu.be,Google
+  # 不含"google"的 Google 域名
+  - DOMAIN-SUFFIX,goog,Google
+  - DOMAIN-SUFFIX,recaptcha.net,Google
+  - DOMAIN-SUFFIX,1e100.net,Google
 
   # ─── 广告拦截 ───
   - RULE-SET,reject,REJECT