diff --git a/cmd/homed-upgrade/main.go b/cmd/homed-upgrade/main.go
index 4730b196..44a1a15c 100644
--- a/cmd/homed-upgrade/main.go
+++ b/cmd/homed-upgrade/main.go
@@ -33,6 +33,7 @@ import (
 	"flag"
 	"fmt"
 	"os"
+	"path/filepath"
 	"strings"
 
 	"github.com/JianFeeeee/HologramAgent/internal/update"
@@ -43,10 +44,11 @@ import (
 //
 // 与生产一致：内核按 `--data <dir>` 运行，标记必须落在同一个 dataDir 下，
 // 否则 update 模块读不到它。推导规则：
-//   ① 环境变量 HOMEAGENT_DATA_DIR（部署方显式指定）
-//   ② 二进制同级的 ../newqqagent（/usr/local/bin/homed → /home/newqqagent）
-//      —— 太脆弱，改为最常见的部署形态：/usr/local/bin/homed → /home/newqqagent
-//   ③ 退回 /home/newqqagent（本仓默认部署路径）
+//
+//	① 环境变量 HOMEAGENT_DATA_DIR（部署方显式指定）
+//	② 二进制同级的 ../newqqagent（/usr/local/bin/homed → /home/newqqagent）
+//	   —— 太脆弱，改为最常见的部署形态：/usr/local/bin/homed → /home/newqqagent
+//	③ 退回 /home/newqqagent（本仓默认部署路径）
 func upgradeDataDir(binPath string) string {
 	if d := strings.TrimSpace(os.Getenv("HOMEAGENT_DATA_DIR")); d != "" {
 		return d
@@ -60,14 +62,15 @@ func fail(format string, a ...interface{}) {
 }
 
 func main() {
-	pkgPath := flag.String("pkg", "", "新安装包（.tar.gz）；给出即做探测")
+	pkgPath := flag.String("pkg", "", "本地安装包（.tar.gz）；与 -release 二选一")
+	release := flag.Bool("release", false, "从 GitHub 最新 Release 下载 OTA 包（默认仅探测；配合 -apply 执行）")
 	binPath := flag.String("bin", "/usr/local/bin/homed", "当前运行的内核二进制路径")
 	pluginsDir := flag.String("plugins", "/home/newqqagent/plugins", "外部插件目录（探测兼容性用）")
 	apply := flag.Bool("apply", false, "真正执行升级（默认只探测+预检）")
 	flag.Parse()
 
-	if *pkgPath == "" {
-		fmt.Fprintln(os.Stderr, "必须提供 -pkg <新安装包.tar.gz>")
+	if *pkgPath == "" && !*release {
+		fmt.Fprintln(os.Stderr, "必须提供 -pkg <安装包.tar.gz> 或 -release")
 		os.Exit(2)
 	}
 
@@ -77,6 +80,16 @@ func main() {
 	}
 	defer os.RemoveAll(tmp)
 
+	if *release {
+		path := filepath.Join(tmp, "release.tar.gz")
+		info, downloadErr := update.DownloadLatestRelease(path)
+		if downloadErr != nil {
+			fail("下载最新 GitHub Release: %v", downloadErr)
+		}
+		*pkgPath = path
+		fmt.Printf("最新 Release: %s (%s)\n", info.Latest, info.Asset)
+	}
+
 	fmt.Printf("== 解包 %s ==\n", *pkgPath)
 	root, err := update.ExtractPkg(*pkgPath, tmp)
 	if err != nil {
@@ -138,4 +151,3 @@ func main() {
 		fail("升级失败: %v", err)
 	}
 }
-
diff --git a/internal/update/release.go b/internal/update/release.go
index c737eec9..3479d383 100644
--- a/internal/update/release.go
+++ b/internal/update/release.go
@@ -1,11 +1,14 @@
 package update
 
 import (
+	"crypto/sha256"
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
 	"os"
+	"path/filepath"
 	"strings"
 	"time"
 )
@@ -30,14 +33,15 @@ var kernelHTTPClient = &http.Client{Timeout: 20 * time.Second}
 
 // ReleaseInfo 是一次「内核检查更新」的结果。
 type ReleaseInfo struct {
-	Current   string `json:"current"`              // 本机版本
-	CurrentC  string `json:"current_commit"`       // 本机 commit
-	Latest    string `json:"latest"`               // 远端最新 release tag
-	LatestURL string `json:"latest_url,omitempty"` // release 页面
-	Asset     string `json:"asset,omitempty"`      // 匹配到的资产名（tar.gz）
-	AssetURL  string `json:"asset_url,omitempty"`  // 资产下载地址
-	HasUpdate bool   `json:"has_update"`
-	Reason    string `json:"reason,omitempty"` // 查不到时的说明
+	Current     string `json:"current"`                // 本机版本
+	CurrentC    string `json:"current_commit"`         // 本机 commit
+	Latest      string `json:"latest"`                 // 远端最新 release tag
+	LatestURL   string `json:"latest_url,omitempty"`   // release 页面
+	Asset       string `json:"asset,omitempty"`        // 匹配到的资产名（tar.gz）
+	AssetURL    string `json:"asset_url,omitempty"`    // 资产下载地址
+	AssetDigest string `json:"asset_digest,omitempty"` // GitHub SHA-256 digest
+	HasUpdate   bool   `json:"has_update"`
+	Reason      string `json:"reason,omitempty"` // 查不到时的说明
 }
 
 // CheckRelease 查 GitHub Release 并与本机版本比较。
@@ -57,6 +61,7 @@ func CheckRelease(current *BinVersion) *ReleaseInfo {
 		Assets  []struct {
 			Name               string `json:"name"`
 			BrowserDownloadURL string `json:"browser_download_url"`
+			Digest             string `json:"digest"`
 		} `json:"assets"`
 	}
 	url := fmt.Sprintf("https://api.github.com/repos/%s/releases/latest", ghRepo())
@@ -76,6 +81,7 @@ func CheckRelease(current *BinVersion) *ReleaseInfo {
 		if strings.Contains(a.Name, "linux") && strings.Contains(a.Name, "amd64") && strings.HasSuffix(a.Name, ".tar.gz") {
 			info.Asset = a.Name
 			info.AssetURL = a.BrowserDownloadURL
+			info.AssetDigest = a.Digest
 			break
 		}
 	}
@@ -110,5 +116,72 @@ func httpGetJSON(url string, v interface{}) error {
 	}
 	return json.NewDecoder(resp.Body).Decode(v)
 }
-
 func osGetenv(k string) string { return os.Getenv(k) }
+
+// DownloadLatestRelease downloads the latest Linux amd64 release asset into dst.
+// The package path is supplied by the caller; the update subsystem owns release
+// discovery, download, and digest verification. It is safe to use from CLI,
+// WebAPI, or an agent tool. No files are replaced by this function.
+func DownloadLatestRelease(dst string) (*ReleaseInfo, error) {
+	info := CheckRelease(nil)
+	if info.AssetURL == "" {
+		return info, fmt.Errorf("latest release has no linux/amd64 tar.gz asset: %s", info.Reason)
+	}
+	if err := downloadFile(info.AssetURL, dst); err != nil {
+		return info, err
+	}
+	if strings.HasPrefix(info.AssetDigest, "sha256:") {
+		want := strings.TrimPrefix(info.AssetDigest, "sha256:")
+		got, err := sha256File(dst)
+		if err != nil {
+			return info, err
+		}
+		if !strings.EqualFold(want, got) {
+			return info, fmt.Errorf("release asset sha256 mismatch: want %s got %s", want, got)
+		}
+	}
+	return info, nil
+}
+
+func downloadFile(url, dst string) error {
+	resp, err := kernelHTTPClient.Get(url)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("download HTTP %d", resp.StatusCode)
+	}
+	if err := os.MkdirAll(filepath.Dir(dst), 0755); err != nil {
+		return err
+	}
+	tmp := dst + ".tmp"
+	f, err := os.Create(tmp)
+	if err != nil {
+		return err
+	}
+	_, copyErr := io.Copy(f, resp.Body)
+	closeErr := f.Close()
+	if copyErr != nil {
+		os.Remove(tmp)
+		return copyErr
+	}
+	if closeErr != nil {
+		os.Remove(tmp)
+		return closeErr
+	}
+	return os.Rename(tmp, dst)
+}
+
+func sha256File(path string) (string, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+	h := sha256.New()
+	if _, err := io.Copy(h, f); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(h.Sum(nil)), nil
+}
diff --git a/scripts/download-ota-release.sh b/scripts/download-ota-release.sh
new file mode 100644
index 00000000..807138ef
--- /dev/null
+++ b/scripts/download-ota-release.sh
@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# Download the latest OTA-capable Linux package from the repository GitHub Release.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+REPO="${HOLOGRAM_RELEASE_REPO:-JianFeeeee/HologramAgent}"
+API="https://api.github.com/repos/${REPO}/releases/latest"
+OUT_DIR="$ROOT/build/package"
+mkdir -p "$OUT_DIR"
+
+command -v curl >/dev/null || {
+	echo "ERROR: curl is required" >&2
+	exit 1
+}
+command -v jq >/dev/null || {
+	echo "ERROR: jq is required" >&2
+	exit 1
+}
+
+release=$(curl --fail --silent --show-error -H 'Accept: application/vnd.github+json' "$API")
+tag=$(printf '%s' "$release" | jq -r '.tag_name // empty')
+release_url=$(printf '%s' "$release" | jq -r '.html_url // empty')
+asset_name=$(printf '%s' "$release" | jq -r '[.assets[]?.name | select(test("linux_amd64\\.tar\\.gz$"; "i"))][0] // empty')
+asset_url=$(printf '%s' "$release" | jq -r --arg name "$asset_name" '.assets[]? | select(.name == $name) | .browser_download_url' | head -1)
+sums_url=$(printf '%s' "$release" | jq -r '.assets[]? | select(.name == "SHA256SUMS") | .browser_download_url' | head -1)
+
+if [[ -z "$tag" || -z "$asset_name" || -z "$asset_url" || -z "$sums_url" ]]; then
+	echo "ERROR: latest release must contain a Linux amd64 tar.gz asset and SHA256SUMS: $API" >&2
+	exit 1
+fi
+
+archive="$OUT_DIR/$asset_name"
+sums="$OUT_DIR/SHA256SUMS-$tag"
+metadata="$OUT_DIR/${asset_name%.tar.gz}.release.txt"
+
+echo "Release: $release_url"
+echo "Downloading: $asset_name"
+curl --fail --location --silent --show-error "$asset_url" -o "$archive"
+curl --fail --location --silent --show-error "$sums_url" -o "$sums"
+
+expected=$(awk -v name="$asset_name" '$2 == name || $2 == "*" name || $2 == "./" name || $2 == "./" name {print $1; exit}' "$sums")
+if [[ -z "$expected" ]]; then
+	echo "ERROR: $asset_name has no SHA256 entry in the Release checksums" >&2
+	exit 1
+fi
+actual=$(sha256sum "$archive" | awk '{print $1}')
+if [[ "$expected" != "$actual" ]]; then
+	echo "ERROR: SHA256 mismatch for $asset_name" >&2
+	echo "expected: $expected" >&2
+	echo "actual:   $actual" >&2
+	exit 1
+fi
+
+{
+	printf 'release_tag=%s\n' "$tag"
+	printf 'release_url=%s\n' "$release_url"
+	printf 'asset_name=%s\n' "$asset_name"
+	printf 'asset_url=%s\n' "$asset_url"
+	printf 'sha256=%s\n' "$actual"
+} >"$metadata"
+
+printf '%s  %s\n' "$actual" "$(basename "$archive")" >"$archive.sha256"
+echo "OTA package: $archive"
+echo "SHA256: $actual"
+echo "Metadata: $metadata"
diff --git a/scripts/make-package.sh b/scripts/make-package.sh
index e331be56..8bd560e0 100755
--- a/scripts/make-package.sh
+++ b/scripts/make-package.sh
@@ -40,12 +40,7 @@ install -m 0644 "$ROOT/build/depgraph.bin" "$OUT/bin/depgraph.bin"
 install -m 0755 "$ROOT/build/waiter" "$OUT/bin/waiter"
 install -m 0755 "$ROOT/build/hmapdev" "$OUT/bin/hmapdev"
 install -m 0755 "$ROOT/build/homed-upgrade" "$OUT/bin/homed-upgrade"
-# 只带 SDK **源码**，排除构建产物。
-#
-# 实测：直接 cp -r 会把 example/commondev/rawfile(321M)、dist(189M)、
-# build/(422M) 等产物一起打进去，包从 319M 涨到 1.3G、文件数 23293。
-# 安装包里 sdk 的用途只有一个——给 hmapdev 现场编译插件提供 SDK 头/源码，
-# 产物对它毫无用处。
+# 只带 SDK 源码，排除构建产物。
 SDK_SRC=third_party/homeagent-sdk
 mkdir -p "$OUT/sdk"
 (cd "$SDK_SRC" && tar -cf - \