diff --git a/.github/workflows/desktop-client-dev.yml b/.github/workflows/desktop-client-dev.yml
index 36ada3c..dd3dedf 100644
--- a/.github/workflows/desktop-client-dev.yml
+++ b/.github/workflows/desktop-client-dev.yml
@@ -109,18 +109,28 @@ jobs:
         run: npm run ${{ matrix.installer_command }}
         working-directory: ./desktop-client
         env:
-          # 添加环境变量以解决macOS构建问题
-          CSC_IDENTITY_AUTO_DISCOVERY: false
           DEBUG: electron-builder
+          # Windows：继续跳过签名（builder 配置已关闭）
+          # macOS：Developer ID 签名 + 公证（需 Secrets: CSC_LINK / CSC_KEY_PASSWORD + Apple ID 三项）
+          CSC_IDENTITY_AUTO_DISCOVERY: ${{ startsWith(matrix.os, 'macos') && 'true' || 'false' }}
+          CSC_LINK: ${{ startsWith(matrix.os, 'macos') && secrets.CSC_LINK || '' }}
+          CSC_KEY_PASSWORD: ${{ startsWith(matrix.os, 'macos') && secrets.CSC_KEY_PASSWORD || '' }}
+          APPLE_ID: ${{ startsWith(matrix.os, 'macos') && secrets.APPLE_ID || '' }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ startsWith(matrix.os, 'macos') && secrets.APPLE_APP_SPECIFIC_PASSWORD || '' }}
+          APPLE_TEAM_ID: ${{ startsWith(matrix.os, 'macos') && secrets.APPLE_TEAM_ID || '' }}
 
       - name: 构建绿色安装包
         if: matrix.green_command != 'null'
         run: npm run ${{ matrix.green_command }}
         working-directory: ./desktop-client
         env:
-          # 添加环境变量以解决macOS构建问题
-          CSC_IDENTITY_AUTO_DISCOVERY: false
           DEBUG: electron-builder
+          CSC_IDENTITY_AUTO_DISCOVERY: ${{ startsWith(matrix.os, 'macos') && 'true' || 'false' }}
+          CSC_LINK: ${{ startsWith(matrix.os, 'macos') && secrets.CSC_LINK || '' }}
+          CSC_KEY_PASSWORD: ${{ startsWith(matrix.os, 'macos') && secrets.CSC_KEY_PASSWORD || '' }}
+          APPLE_ID: ${{ startsWith(matrix.os, 'macos') && secrets.APPLE_ID || '' }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ startsWith(matrix.os, 'macos') && secrets.APPLE_APP_SPECIFIC_PASSWORD || '' }}
+          APPLE_TEAM_ID: ${{ startsWith(matrix.os, 'macos') && secrets.APPLE_TEAM_ID || '' }}
 
       - name: 列出dist目录内容
         run: |
diff --git a/assets/wechat-q.jpg b/assets/wechat-q.jpg
index b9524d5..5803460 100644
Binary files a/assets/wechat-q.jpg and b/assets/wechat-q.jpg differ
diff --git a/desktop-client/assets/entitlements.mac.plist b/desktop-client/assets/entitlements.mac.plist
index 7d4fa52..ebe0d76 100644
--- a/desktop-client/assets/entitlements.mac.plist
+++ b/desktop-client/assets/entitlements.mac.plist
@@ -2,42 +2,26 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
   <dict>
-    <!-- Enable app sandbox -->
+    <!-- Developer ID 分发：不启用 App Sandbox，避免草稿目录等路径被沙箱拦截 -->
     <key>com.apple.security.app-sandbox</key>
+    <false/>
+
+    <!-- Electron + Hardened Runtime 必需 -->
+    <key>com.apple.security.cs.allow-jit</key>
     <true/>
-    
-    <!-- File access permissions -->
-    <key>com.apple.security.files.user-selected.read-write</key>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
     <true/>
-    
-    <!-- Access to user's Downloads folder -->
-    <key>com.apple.security.files.downloads.read-write</key>
+    <key>com.apple.security.cs.disable-library-validation</key>
     <true/>
-    
-    <!-- Access to user's Documents folder -->
-    <key>com.apple.security.files.documents.read-write</key>
-    <true/>
-    
-    <!-- Access to user's Pictures folder -->
-    <key>com.apple.security.files.pictures.read-write</key>
-    <true/>
-    
-    <!-- Access to user's Music folder -->
-    <key>com.apple.security.files.music.read-write</key>
-    <true/>
-    
-    <!-- Access to user's Movies folder -->
-    <key>com.apple.security.files.movies.read-write</key>
-    <true/>
-    
-    <!-- Network access -->
+
+    <!-- 网络 -->
     <key>com.apple.security.network.client</key>
     <true/>
-    
-    <!-- Hardware access for media files -->
-    <key>com.apple.security.device.audio-input</key>
-    <false/>
-    <key>com.apple.security.device.camera</key>
-    <false/>
+    <key>com.apple.security.network.server</key>
+    <true/>
+
+    <!-- 用户选择的文件读写（非沙箱场景下仍建议保留） -->
+    <key>com.apple.security.files.user-selected.read-write</key>
+    <true/>
   </dict>
-</plist>
\ No newline at end of file
+</plist>
diff --git a/desktop-client/scripts/electron-builder-green.config.js b/desktop-client/scripts/electron-builder-green.config.js
index 4825367..7f023cd 100644
--- a/desktop-client/scripts/electron-builder-green.config.js
+++ b/desktop-client/scripts/electron-builder-green.config.js
@@ -1,3 +1,9 @@
+function macNotarize() {
+  const teamId = process.env.APPLE_TEAM_ID;
+  if (!teamId) return false;
+  return { teamId };
+}
+
 module.exports = {
   appId: "com.gogoshine.capcutmate",
   productName: "CapCut-Mate",
@@ -18,7 +24,8 @@ module.exports = {
     hardenedRuntime: true,
     gatekeeperAssess: false,
     entitlements: "assets/entitlements.mac.plist",
-    entitlementsInherit: "assets/entitlements.mac.plist"
+    entitlementsInherit: "assets/entitlements.mac.plist",
+    notarize: macNotarize()
   },
   files: [
     "!node_modules/**/*",
diff --git a/desktop-client/scripts/electron-builder.config.js b/desktop-client/scripts/electron-builder.config.js
index 24c2eac..f0991c9 100644
--- a/desktop-client/scripts/electron-builder.config.js
+++ b/desktop-client/scripts/electron-builder.config.js
@@ -1,8 +1,15 @@
 /**
  * Electron Builder Configuration
  */
+function macNotarize() {
+  const teamId = process.env.APPLE_TEAM_ID;
+  // 本地无 Team ID 时跳过公证；CI 注入 APPLE_TEAM_ID + Apple ID 凭据后启用
+  if (!teamId) return false;
+  return { teamId };
+}
+
 module.exports = {
-  appId: "com.gogoshine.capcut-mate",
+  appId: "com.gogoshine.capcutmate",
   productName: "剪映小助手",
   directories: {
     output: "dist"
@@ -53,7 +60,8 @@ module.exports = {
     hardenedRuntime: true,
     gatekeeperAssess: false,
     entitlements: "assets/entitlements.mac.plist",
-    entitlementsInherit: "assets/entitlements.mac.plist"
+    entitlementsInherit: "assets/entitlements.mac.plist",
+    notarize: macNotarize()
   },
   dmg: {
     background: null,