diff --git a/.github/workflows/release-tauri.yml b/.github/workflows/release-tauri.yml
index 91b2cc59..bfe4797a 100644
--- a/.github/workflows/release-tauri.yml
+++ b/.github/workflows/release-tauri.yml
@@ -637,3 +637,93 @@ jobs:
             openless-all/app/src-tauri/target/release/bundle/appimage/*.AppImage
             openless-all/app/src-tauri/target/release/bundle/appimage/*.AppImage.sig
             openless-all/app/src-tauri/target/release/bundle/latest-*.json
+
+  # ── 正式版发布后，自动更新 Homebrew cask ──
+  # 为什么放进这条流水线，而不是单独的 `release: published` 工作流：softprops 用默认
+  # GITHUB_TOKEN 创建的 Release 不会触发 `release` 事件的其它工作流（GitHub 防递归），
+  # 所以独立的 update-cask 工作流永远不会被自动触发（历史上只在一次手动场景跑过且失败）。
+  # 用 needs: build 串在构建之后、同一条流水线里，才能保证每次正式发版都自动更新 cask。
+  #
+  # 仅正式版：v*-tauri 且非 -beta-tauri。beta 不碰 Homebrew，避免把预发布版推给
+  # `brew install --cask openless` 的用户。cask 文件在默认分支（beta）上，提交回该分支。
+  update-homebrew-cask:
+    name: Update Homebrew cask (stable only)
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    if: >-
+      startsWith(github.ref, 'refs/tags/v')
+      && endsWith(github.ref, '-tauri')
+      && !endsWith(github.ref, '-beta-tauri')
+    steps:
+      - name: Checkout default branch (cask 住在这里)
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Resolve version + DMG sha256 from the release
+        id: meta
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          version="${TAG#v}"
+          version="${version%-tauri}"
+
+          # 直接下载 DMG 自己算 sha256，不依赖 GitHub 资产 digest 字段的时序/可用性。
+          mkdir -p "$RUNNER_TEMP/dmg"
+          gh release download "$TAG" --repo "$GITHUB_REPOSITORY" \
+            --dir "$RUNNER_TEMP/dmg" \
+            --pattern '*aarch64.dmg' --pattern '*_x64.dmg'
+
+          arm_sha="$(sha256sum "$RUNNER_TEMP"/dmg/*aarch64.dmg | cut -d' ' -f1)"
+          intel_sha="$(sha256sum "$RUNNER_TEMP"/dmg/*_x64.dmg | cut -d' ' -f1)"
+
+          {
+            echo "version=$version"
+            echo "arm_sha=$arm_sha"
+            echo "intel_sha=$intel_sha"
+          } >> "$GITHUB_OUTPUT"
+          echo "cask → version=$version arm=$arm_sha intel=$intel_sha"
+
+      - name: Update Casks/openless.rb
+        env:
+          VERSION: ${{ steps.meta.outputs.version }}
+          ARM_SHA: ${{ steps.meta.outputs.arm_sha }}
+          INTEL_SHA: ${{ steps.meta.outputs.intel_sha }}
+        run: |
+          set -euo pipefail
+          cask="Casks/openless.rb"
+          # ⚠️ cask 第 2 行 `arch arm: "aarch64", intel: "x64"` 也含 `intel: "..."`，
+          # 裸 `s/intel: "..."/` 会把 arch 指令一起改成哈希 → Intel 用户 brew 装包 404。
+          # 所以 intel 的 sed 用 `^[[:space:]]*intel:` 锚定 sha256 块那一行；arm 的 sed
+          # 靠 `sha256 arm:   ` 前缀天然只命中 sha256 行。捕获组 \1 保留原缩进。
+          sed -i "s/version \"[^\"]*\"/version \"$VERSION\"/" "$cask"
+          sed -i "s/sha256 arm:   \"[^\"]*\"/sha256 arm:   \"$ARM_SHA\"/" "$cask"
+          sed -i "s/^\([[:space:]]*\)intel: \"[^\"]*\"/\1intel: \"$INTEL_SHA\"/" "$cask"
+          # 防呆：arch 指令必须原样保留，且本次 sha256 必须确实写进去了，否则让 job 失败。
+          grep -q 'arch arm: "aarch64", intel: "x64"' "$cask" \
+            || { echo "::error::arch 指令被 sed 误伤"; exit 1; }
+          grep -q "\"$ARM_SHA\"" "$cask" && grep -q "\"$INTEL_SHA\"" "$cask" \
+            || { echo "::error::sha256 未正确写入 cask"; exit 1; }
+          echo "----- updated $cask -----"
+          cat "$cask"
+
+      - name: Commit & push cask bump
+        env:
+          VERSION: ${{ steps.meta.outputs.version }}
+        run: |
+          set -euo pipefail
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add Casks/openless.rb
+          if git diff --cached --quiet; then
+            echo "cask 已是 $VERSION，无需提交"
+            exit 0
+          fi
+          # [skip ci]：cask 文本改动不需要再跑一遍跨平台 ci.yml。
+          git commit -m "[cask] openless $VERSION (auto from release) [skip ci]"
+          git push
diff --git a/.github/workflows/update-cask.yml b/.github/workflows/update-cask.yml
deleted file mode 100644
index feea2912..00000000
--- a/.github/workflows/update-cask.yml
+++ /dev/null
@@ -1,83 +0,0 @@
-name: Update Cask on Release
-
-on:
-  release:
-    types: [published]
-
-jobs:
-  update-cask:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    if: startsWith(github.event.release.tag_name, 'v') && endsWith(github.event.release.tag_name, '-tauri')
-    steps:
-      - name: Checkout tap repository
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract version from tag
-        id: version
-        run: |
-          TAG="${{ github.event.release.tag_name }}"
-          VERSION="${TAG#v}"
-          VERSION="${VERSION%-tauri}"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "Detected version: $VERSION"
-
-      - name: Fetch release assets SHA256
-        id: sha256
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          REPO="${{ github.repository }}"
-          
-          # Fetch release assets info
-          RESPONSE=$(gh api "repos/$REPO/releases/tags/v${VERSION}-tauri")
-          
-          # Extract SHA256 for aarch64 DMG
-          ARM64_SHA=$(echo "$RESPONSE" | jq -r '.assets[] | select(.name | contains("aarch64.dmg")) | .digest' | sed 's/sha256://')
-          
-          # Extract SHA256 for x64 DMG
-          X64_SHA=$(echo "$RESPONSE" | jq -r '.assets[] | select(.name | contains("_x64.dmg")) | .digest' | sed 's/sha256://')
-          
-          echo "arm64_sha=$ARM64_SHA" >> "$GITHUB_OUTPUT"
-          echo "x64_sha=$X64_SHA" >> "$GITHUB_OUTPUT"
-          
-          echo "aarch64 DMG SHA256: $ARM64_SHA"
-          echo "x64 DMG SHA256: $X64_SHA"
-
-      - name: Update Cask file
-        run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          ARM64_SHA="${{ steps.sha256.outputs.arm64_sha }}"
-          X64_SHA="${{ steps.sha256.outputs.x64_sha }}"
-          CASK_FILE="Casks/openless.rb"
-          
-          # Update version
-          sed -i "s/version \"[^\"]*\"/version \"$VERSION\"/" "$CASK_FILE"
-          
-          # Update SHA256 values
-          sed -i "s/sha256 arm:   \"[^\"]*\"/sha256 arm:   \"$ARM64_SHA\"/" "$CASK_FILE"
-          sed -i "s/intel: \"[^\"]*\"/intel: \"$X64_SHA\"/" "$CASK_FILE"
-          
-          echo "Updated $CASK_FILE:"
-          cat "$CASK_FILE"
-
-      - name: Commit and push changes
-        run: |
-          git config --local user.email "github-actions[bot]@users.noreply.github.com"
-          git config --local user.name "github-actions[bot]"
-          
-          VERSION="${{ steps.version.outputs.version }}"
-          
-          git add Casks/openless.rb
-          
-          if git diff --cached --quiet; then
-            echo "No changes to commit"
-            exit 0
-          fi
-          
-          git commit -m "[cask] Update openless to $VERSION"
-          git push
diff --git a/Casks/openless.rb b/Casks/openless.rb
index b1b47f54..825b6d7b 100644
--- a/Casks/openless.rb
+++ b/Casks/openless.rb
@@ -1,9 +1,9 @@
 cask "openless" do
   arch arm: "aarch64", intel: "x64"
 
-  version "1.3.4"
-  sha256 arm:   "609e583bc3dc41467ac7c151d8fa6b11702027e1ae565bb682b0129f19db698c",
-         intel: "bb77915b7b410465a1c935bc267b07e3f2a4e700dda905ab713457204867de09"
+  version "1.3.5"
+  sha256 arm:   "88cd4828d18812c80bb05c96ef2346cddf61360d8392b09bf4426af7fce2031a",
+         intel: "6fa1960f39a103cd2d4656429406e70a7ae6f1f344948bd9916b961e9494c622"
 
   url "https://github.com/appergb/openless/releases/download/v#{version}-tauri/OpenLess_#{version}_#{arch}.dmg"
   name "OpenLess"