diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index fbd36293..d046447c 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -42,6 +42,10 @@ jobs:
       MACOS_SIGNING_P12_BASE64: ${{ secrets.MACOS_SIGNING_P12_BASE64 }}
       MACOS_SIGNING_P12_PASSWORD: ${{ secrets.MACOS_SIGNING_P12_PASSWORD }}
       MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }}
+      # 公证（P2 后半，rant 2026-08-06T10:06:55）：APPLE_ID 等 Secret 未配则跳过降级
+      APPLE_ID: ${{ secrets.APPLE_ID }}
+      MACOS_NOTARY_APP_PASSWORD: ${{ secrets.MACOS_NOTARY_APP_PASSWORD }}
+      MACOS_NOTARY_TEAM_ID: ${{ secrets.MACOS_NOTARY_TEAM_ID }}
     steps:
       - uses: actions/checkout@v5
 
@@ -133,6 +137,29 @@ jobs:
           mv "${PKG}.signed" "$PKG"
           pkgutil --check-signature "$PKG" || true
 
+      # ── pkg 公证（macOS only，P2 后半；Secret 未配则跳过降级）──
+      # notarytool submit --wait：轮询直至 Accepted/Invalid，失败即非零退出 → CI 失败
+      - name: Notarize pkg (macOS only)
+        if: runner.os == 'macOS' && env.APPLE_ID != '' && env.MACOS_NOTARY_APP_PASSWORD != '' && env.MACOS_NOTARY_TEAM_ID != ''
+        shell: bash
+        run: |
+          PKG="$(find dist/artifacts -maxdepth 1 -name 'EMRG-*-macos-*.pkg' | head -1)"
+          if [ -z "$PKG" ]; then echo "no pkg found, skipping"; exit 0; fi
+          xcrun notarytool submit "$PKG" \
+            --apple-id "$APPLE_ID" \
+            --password "$MACOS_NOTARY_APP_PASSWORD" \
+            --team-id "$MACOS_NOTARY_TEAM_ID" \
+            --wait --output-format json
+
+      - name: Staple pkg (macOS only)
+        if: runner.os == 'macOS' && env.APPLE_ID != '' && env.MACOS_NOTARY_APP_PASSWORD != '' && env.MACOS_NOTARY_TEAM_ID != ''
+        shell: bash
+        run: |
+          PKG="$(find dist/artifacts -maxdepth 1 -name 'EMRG-*-macos-*.pkg' | head -1)"
+          if [ -z "$PKG" ]; then echo "no pkg found, skipping"; exit 0; fi
+          xcrun stapler staple "$PKG"
+          xcrun stapler validate "$PKG"
+
       # ── 冒烟（§12，临时 HOME + 无 Python runner）────────────
       - name: Smoke test (R42 temp HOME)
         shell: bash