diff --git a/.github/workflows/release-tauri.yml b/.github/workflows/release-tauri.yml
index 85c81737..f7668950 100644
--- a/.github/workflows/release-tauri.yml
+++ b/.github/workflows/release-tauri.yml
@@ -226,13 +226,16 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         run: |
           set +e
+          # 顺序很关键：NSIS 必须先跑、产出 *_x64-setup.exe(.sig) 给 updater 用。
+          # Tauri 的 "all" 默认按字母序 msi→nsis，MSI 一旦 ICE80 挂掉就 short-circuit
+          # 整个 bundle 流程，NSIS 完全没机会执行。显式 --bundles nsis,msi 强制顺序。
           if [ -n "${TAURI_SIGNING_PRIVATE_KEY:-}" ]; then
-            npm run tauri -- build --config '{"bundle":{"createUpdaterArtifacts":true}}'
+            npm run tauri -- build --bundles nsis,msi --config '{"bundle":{"createUpdaterArtifacts":true}}'
           else
-            npm run tauri build
+            npm run tauri -- build --bundles nsis,msi
           fi
           echo "TAURI_BUILD_EXIT=$?" >> "$GITHUB_ENV"
-          # 不直接退出失败：下一步 Repair 还有兜底机会。
+          # 不直接退出失败：下一步 Repair 还有兜底机会（NSIS 已先于 MSI 写盘）。
           exit 0
 
       # ── 如果 tauri 在 wix link 阶段失败（candle 出了 wixobj，但 light 因 cwd
diff --git a/openless-all/app/package-lock.json b/openless-all/app/package-lock.json
index ed870da0..12b4138a 100644
--- a/openless-all/app/package-lock.json
+++ b/openless-all/app/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "openless-app",
-  "version": "1.2.17",
+  "version": "1.2.18",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "openless-app",
-      "version": "1.2.17",
+      "version": "1.2.18",
       "dependencies": {
         "@tauri-apps/api": "^2.1.1",
         "@tauri-apps/plugin-autostart": "^2.5.1",
diff --git a/openless-all/app/package.json b/openless-all/app/package.json
index 44440af5..d3ad929b 100644
--- a/openless-all/app/package.json
+++ b/openless-all/app/package.json
@@ -1,7 +1,7 @@
 {
   "name": "openless-app",
   "private": true,
-  "version": "1.2.17",
+  "version": "1.2.18",
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/openless-all/app/src-tauri/Cargo.lock b/openless-all/app/src-tauri/Cargo.lock
index 6ddee10a..e4c2b66d 100644
--- a/openless-all/app/src-tauri/Cargo.lock
+++ b/openless-all/app/src-tauri/Cargo.lock
@@ -3281,7 +3281,7 @@ dependencies = [
 
 [[package]]
 name = "openless"
-version = "1.2.17"
+version = "1.2.18"
 dependencies = [
  "anyhow",
  "arboard",
diff --git a/openless-all/app/src-tauri/Cargo.toml b/openless-all/app/src-tauri/Cargo.toml
index f3b72c47..2fbcd61a 100644
--- a/openless-all/app/src-tauri/Cargo.toml
+++ b/openless-all/app/src-tauri/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "openless"
-version = "1.2.17"
+version = "1.2.18"
 description = "OpenLess — local voice input that types where your cursor is"
 authors = ["OpenLess"]
 edition = "2021"
diff --git a/openless-all/app/src-tauri/tauri.conf.json b/openless-all/app/src-tauri/tauri.conf.json
index 5b667e4e..6a0e9c77 100644
--- a/openless-all/app/src-tauri/tauri.conf.json
+++ b/openless-all/app/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "OpenLess",
-  "version": "1.2.17",
+  "version": "1.2.18",
   "identifier": "com.openless.app",
   "build": {
     "beforeDevCommand": "npm run dev",