diff --git a/streampark-console/streampark-console-service/src/main/assembly/bin/jvm_opts.sh b/streampark-console/streampark-console-service/src/main/assembly/bin/jvm_opts.sh
index 0cc621a8cd..392a7e6755 100644
--- a/streampark-console/streampark-console-service/src/main/assembly/bin/jvm_opts.sh
+++ b/streampark-console/streampark-console-service/src/main/assembly/bin/jvm_opts.sh
@@ -27,3 +27,9 @@
 # Required for dynamic classpath (ClassLoaderUtils) on JDK 9+. Ignored on JDK 8.
 --add-opens java.base/jdk.internal.loader=ALL-UNNAMED
 --add-opens jdk.zipfs/jdk.nio.zipfs=ALL-UNNAMED
+
+# Required for FlinkClient#submit's ExitSecurityManager (used to intercept System.exit()
+# calls made by the Flink CLI during in-process job submission) on JDK 18+, where
+# System.setSecurityManager() throws UnsupportedOperationException unless explicitly
+# allowed (JEP 411). Ignored on JDK 17 and earlier.
+-Djava.security.manager=allow