diff --git a/plugins/wasm-go/extensions/jwt-auth/Dockerfile b/plugins/wasm-go/extensions/jwt-auth/Dockerfile
new file mode 100644
index 000000000..50c0bbe3b
--- /dev/null
+++ b/plugins/wasm-go/extensions/jwt-auth/Dockerfile
@@ -0,0 +1,2 @@
+FROM scratch
+COPY main.wasm plugin.wasm
diff --git a/plugins/wasm-go/extensions/jwt-auth/handler/verify.go b/plugins/wasm-go/extensions/jwt-auth/handler/verify.go
index eac051912..430a832b0 100644
--- a/plugins/wasm-go/extensions/jwt-auth/handler/verify.go
+++ b/plugins/wasm-go/extensions/jwt-auth/handler/verify.go
@@ -79,7 +79,7 @@ func consumerVerify(consumer *cfg.Consumer, verifyTime time.Time, log wrapper.Lo
 
 	// Claims 支持直接传入 jose 的 jwks 并自动选择合适的公钥
 	// 无需额外调用verify，claims内部已进行验证
-	err = token.Claims(keys, out)
+	err = token.Claims(keys, &out)
 	if err != nil {
 		return &ErrDenied{
 			msg: fmt.Sprintf("jwt verify failed, consumer: %s, token: %s, reason: %s",