diff --git a/openless-all/app/package.json b/openless-all/app/package.json
index 6bdf51ec..843703bf 100644
--- a/openless-all/app/package.json
+++ b/openless-all/app/package.json
@@ -1,7 +1,7 @@
 {
   "name": "openless-app",
   "private": true,
-  "version": "1.2.2",
+  "version": "1.2.3",
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/openless-all/app/src-tauri/Cargo.lock b/openless-all/app/src-tauri/Cargo.lock
index 321e00d9..0311fd9f 100644
--- a/openless-all/app/src-tauri/Cargo.lock
+++ b/openless-all/app/src-tauri/Cargo.lock
@@ -3250,7 +3250,7 @@ dependencies = [
 
 [[package]]
 name = "openless"
-version = "1.2.2"
+version = "1.2.3"
 dependencies = [
  "anyhow",
  "arboard",
diff --git a/openless-all/app/src-tauri/Cargo.toml b/openless-all/app/src-tauri/Cargo.toml
index 4ac05434..68dce5bd 100644
--- a/openless-all/app/src-tauri/Cargo.toml
+++ b/openless-all/app/src-tauri/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "openless"
-version = "1.2.2"
+version = "1.2.3"
 description = "OpenLess — local voice input that types where your cursor is"
 authors = ["OpenLess"]
 edition = "2021"
diff --git a/openless-all/app/src-tauri/src/lib.rs b/openless-all/app/src-tauri/src/lib.rs
index 1121287f..01b33e2b 100644
--- a/openless-all/app/src-tauri/src/lib.rs
+++ b/openless-all/app/src-tauri/src/lib.rs
@@ -191,6 +191,26 @@ pub fn run() {
 
 #[tauri::command]
 fn restart_app(app: AppHandle) {
+    // macOS：自动更新会让新装的 .app 带 com.apple.quarantine（无论 Tauri updater
+    // 怎么解包，下载流由 LaunchServices 接管，输出物可能仍带 xattr）。如果不
+    // strip，重启后 Gatekeeper 会拦着说"OpenLess 已损坏 / 来自未识别开发者"，
+    // 用户必须自己开终端跑 xattr -cr 才能继续用 — 违反了"自动更新对用户应该零摩擦"。
+    //
+    // 在 restart 前阻塞地清一次 xattr。失败容忍（PATH 异常、xattr 不存在、磁盘
+    // 只读等边角情况），不让它阻塞重启本身。
+    #[cfg(target_os = "macos")]
+    if let Ok(exe) = std::env::current_exe() {
+        if let Some(bundle) = exe
+            .ancestors()
+            .find(|p| p.extension().map(|e| e == "app").unwrap_or(false))
+        {
+            let _ = std::process::Command::new("/usr/bin/xattr")
+                .arg("-cr")
+                .arg(bundle)
+                .status();
+            log::info!("[updater] stripped xattr on {:?} before restart", bundle);
+        }
+    }
     app.restart();
 }
 
diff --git a/openless-all/app/src-tauri/tauri.conf.json b/openless-all/app/src-tauri/tauri.conf.json
index af421d31..19260e0f 100644
--- a/openless-all/app/src-tauri/tauri.conf.json
+++ b/openless-all/app/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "OpenLess",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "identifier": "com.openless.app",
   "build": {
     "beforeDevCommand": "npm run dev",
@@ -68,7 +68,7 @@
   },
   "plugins": {
     "updater": {
-      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDFERUFBODAzNTY0QzMyM0YKUldRL01reFdBNmpxSGE1K0JadlpONXNWTzhJcGZCRGxjUVdIWExNNFJpeUNsSGZwazdlQThhemkK",
+      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IEYwRkNERTY4RTA4RTZENEUKUldST2JZN2dhTjc4OE92OWpSR3dlYzAzVm13cG9jd1p6cytUZnVwc3IycnJwTHNDU0xMOThxdmEK",
       "endpoints": [
         "https://github.com/appergb/openless/releases/latest/download/latest-{{target}}-{{arch}}.json"
       ]