diff --git a/application/src/main/resources/extensions/attachment-local-policy.yaml b/application/src/main/resources/extensions/attachment-local-policy.yaml
index a0926ade60..0ed8d79ff0 100644
--- a/application/src/main/resources/extensions/attachment-local-policy.yaml
+++ b/application/src/main/resources/extensions/attachment-local-policy.yaml
@@ -10,6 +10,8 @@ apiVersion: storage.halo.run/v1alpha1
 kind: Policy
 metadata:
   name: default-policy
+  labels:
+    halo.run/do-not-overwrite: "true"
   finalizers:
     - system-protection
 spec:
diff --git a/application/src/test/java/run/halo/app/core/attachment/AttachmentLocalPolicyResourceTest.java b/application/src/test/java/run/halo/app/core/attachment/AttachmentLocalPolicyResourceTest.java
new file mode 100644
index 0000000000..1c78018087
--- /dev/null
+++ b/application/src/test/java/run/halo/app/core/attachment/AttachmentLocalPolicyResourceTest.java
@@ -0,0 +1,54 @@
+package run.halo.app.core.attachment;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.core.io.ClassPathResource;
+import run.halo.app.extension.ExtensionUtil;
+import run.halo.app.infra.utils.YamlUnstructuredLoader;
+
+/**
+ * Tests for the built-in local attachment policy resource.
+ *
+ * <p>The default policy (and its config map) are initialized from <code>extensions/attachment-local-policy.yaml</code>
+ * on every startup. The <code>halo.run/do-not-overwrite</code> label is required to prevent the initializer from
+ * reverting user modifications, such as the display priority label, on restart.
+ *
+ * @author bedhere
+ * @since 2.27.0
+ */
+class AttachmentLocalPolicyResourceTest {
+
+    @Test
+    void defaultPolicyShouldBeMarkedAsDoNotOverwrite() {
+        var resource = new ClassPathResource("extensions/attachment-local-policy.yaml");
+        var unstructuredList = new YamlUnstructuredLoader(resource).load();
+
+        var defaultPolicy = unstructuredList.stream()
+                .filter(unstructured -> "Policy".equals(unstructured.getKind()))
+                .filter(unstructured ->
+                        "default-policy".equals(unstructured.getMetadata().getName()))
+                .findFirst()
+                .orElseThrow();
+
+        assertThat(defaultPolicy.getMetadata().getLabels())
+                .as("Default policy must not be overwritten on startup, otherwise user "
+                        + "modifications (e.g. upload display priority) are reverted on restart.")
+                .containsEntry(ExtensionUtil.DO_NOT_OVERWRITE_LABEL, "true");
+    }
+
+    @Test
+    void defaultPolicyConfigMapShouldBeMarkedAsDoNotOverwrite() {
+        var resource = new ClassPathResource("extensions/attachment-local-policy.yaml");
+        var unstructuredList = new YamlUnstructuredLoader(resource).load();
+
+        var configMap = unstructuredList.stream()
+                .filter(unstructured -> "ConfigMap".equals(unstructured.getKind()))
+                .filter(unstructured -> "default-policy-config"
+                        .equals(unstructured.getMetadata().getName()))
+                .findFirst()
+                .orElseThrow();
+
+        assertThat(configMap.getMetadata().getLabels()).containsEntry(ExtensionUtil.DO_NOT_OVERWRITE_LABEL, "true");
+    }
+}
diff --git a/application/src/test/java/run/halo/app/infra/ExtensionResourceInitializerTest.java b/application/src/test/java/run/halo/app/infra/ExtensionResourceInitializerTest.java
index cec6dfbe8f..a315145643 100644
--- a/application/src/test/java/run/halo/app/infra/ExtensionResourceInitializerTest.java
+++ b/application/src/test/java/run/halo/app/infra/ExtensionResourceInitializerTest.java
@@ -10,6 +10,7 @@
 import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Map;
 import java.util.Set;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
@@ -24,6 +25,7 @@
 import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.util.FileSystemUtils;
 import reactor.core.publisher.Mono;
+import run.halo.app.extension.ExtensionUtil;
 import run.halo.app.extension.GroupVersionKind;
 import run.halo.app.extension.ReactiveExtensionClient;
 import run.halo.app.extension.Unstructured;
@@ -165,4 +167,25 @@ void shouldStartCorrectly() throws Exception {
             ]
             """, JsonUtils.objectToJson(values), false);
     }
+
+    @Test
+    void shouldNotUpdateExtensionWithDoNotOverwriteLabel() throws Exception {
+        when(haloProperties.isRequiredExtensionDisabled()).thenReturn(true);
+        var existing = new Unstructured(Map.of(
+                "apiVersion", "v1",
+                "kind", "FakeExtension",
+                "metadata",
+                        Map.of(
+                                "name",
+                                "fake-extension",
+                                "labels",
+                                Map.of(ExtensionUtil.DO_NOT_OVERWRITE_LABEL, "true"))));
+
+        when(extensionClient.fetch(any(GroupVersionKind.class), any())).thenReturn(Mono.just(existing));
+
+        extensionResourceInitializer.start();
+
+        verify(extensionClient, never()).update(any());
+        verify(extensionClient, never()).create(any());
+    }
 }