diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 084828f..6d52d9e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -130,7 +130,6 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          DSH_DESKTOP_UPDATER_PUBKEY: ${{ secrets.DSH_DESKTOP_UPDATER_PUBKEY }}
         with:
           projectPath: .
           tagName: v__VERSION__
diff --git a/scripts/setup-gitea-release.sh b/scripts/setup-gitea-release.sh
index 69b9f7d..2558123 100755
--- a/scripts/setup-gitea-release.sh
+++ b/scripts/setup-gitea-release.sh
@@ -76,7 +76,14 @@ gh auth status >/dev/null
 confirm '现在写入 GITEA_TOKEN 与 Tauri 签名 secrets 吗？' || exit 1
 printf '%s' "$GITEA_TOKEN" | gh secret set GITEA_TOKEN
 cat "$PRIVATE_KEY_PATH" | gh secret set TAURI_SIGNING_PRIVATE_KEY
-cat "$PUBLIC_KEY_PATH" | gh secret set DSH_DESKTOP_UPDATER_PUBKEY
+python3 - "$PUBLIC_KEY_PATH" <<'PY'
+import json, pathlib, sys
+conf = pathlib.Path("src-tauri/tauri.conf.json")
+data = json.loads(conf.read_text(encoding="utf-8"))
+data["plugins"]["updater"]["pubkey"] = pathlib.Path(sys.argv[1]).read_text(encoding="utf-8").strip()
+conf.write_text(json.dumps(data, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+PY
+echo "公钥已写入 src-tauri/tauri.conf.json（随仓库提交）"
 if [[ -n "$SIGNING_PASSWORD" ]]; then
   printf '%s' "$SIGNING_PASSWORD" | gh secret set TAURI_SIGNING_PRIVATE_KEY_PASSWORD
 fi
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index 745ab3b..011a1a7 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -17,7 +17,7 @@
   },
   "plugins": {
     "updater": {
-      "pubkey": ""
+      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDM1OEI5NkQwMjJCNkFDODMKUldTRHJMWWkwSmFMTlcza3Vkd1UxclQydm0xOW9MTVNxU1JIckkreWRwc1dMTm1HOVVaMHI1SysK"
     }
   },
   "bundle": {