diff --git a/.gitignore b/.gitignore
index f3f9a02..ec27f1c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,7 +3,4 @@ __pycache__/
 .ruff_cache/
 *.egg-info/
 build/
-dist/*
-!dist/
-!dist/ictlogin.pyz
-!dist/ictlogin.pyz.sha256
+dist/
diff --git a/README.md b/README.md
index 1a92e2b..6f638f0 100644
--- a/README.md
+++ b/README.md
@@ -24,21 +24,34 @@ python3 scripts/build_release.py
 (cd dist && sha256sum -c ictlogin.pyz.sha256)
 ```
 
-在包含 `install.sh` 和 `dist/ictlogin.pyz` 的目录中执行：
+`dist/` 只用于本地构建，已被 Git 忽略。维护者可以将构建产物上传到 Gitea Release：
+
+```bash
+tea releases assets create --repo mancitrus/ictlogin v0.2.0 \
+  dist/ictlogin.pyz dist/ictlogin.pyz.sha256 install.sh
+```
+
+服务器上可直接从公开仓库获取安装脚本并安装当前 Release：
+
+```bash
+curl --fail --location https://gitx.roy1994.top/mancitrus/ictlogin/raw/branch/main/install.sh | sh
+```
+
+也可以在本地保存 `install.sh` 后执行：
 
 ```bash
 ./install.sh
 ```
 
-安装脚本默认写入 `~/.local/bin/ictlogin`，会自动校验同目录的 `.sha256` 文件。也可以从指定文件或 URL 安装：
+安装脚本默认从公开的 `v0.2.0` Release 下载 `ictlogin.pyz` 及其 `.sha256` 校验文件，写入 `~/.local/bin/ictlogin`。可通过 `ICTLOGIN_RELEASE_TAG` 选择其他 Release。也可以从指定文件或 URL 安装：
 
 ```bash
 ./install.sh --source /path/to/ictlogin.pyz --prefix "$HOME/.local/bin"
 ICTLOGIN_PYZ_URL="https://example.invalid/ictlogin.pyz" ./install.sh
+ICTLOGIN_PYZ_URL="https://example.invalid/ictlogin.pyz" \
+  ICTLOGIN_PYZ_SHA256_URL="https://example.invalid/ictlogin.pyz.sha256" ./install.sh
 ```
 
-当前 Gitea 仓库是私有仓库；在没有仓库访问凭据的服务器上，请先通过 `scp` 复制 `install.sh`、`dist/ictlogin.pyz` 和 `dist/ictlogin.pyz.sha256`，再运行安装脚本。
-
 ## 使用
 
 先检查当前 IP：
diff --git a/install.sh b/install.sh
index b97175b..47b8d9b 100755
--- a/install.sh
+++ b/install.sh
@@ -16,7 +16,9 @@ Options:
 Environment overrides:
   ICTLOGIN_PYZ            local .pyz path or URL
   ICTLOGIN_PYZ_URL        download URL when no local artifact is present
+  ICTLOGIN_PYZ_SHA256_URL checksum URL for a downloaded .pyz
   ICTLOGIN_PYZ_SHA256     expected SHA-256
+  ICTLOGIN_RELEASE_TAG    public Gitea release tag (default: v0.2.0)
   ICTLOGIN_PREFIX         install directory
   ICTLOGIN_PYTHON         Python 3 executable
 EOF
@@ -24,8 +26,11 @@ EOF
 
 SOURCE="${ICTLOGIN_PYZ:-}"
 URL="${ICTLOGIN_PYZ_URL:-}"
+CHECKSUM_URL="${ICTLOGIN_PYZ_SHA256_URL:-}"
 EXPECTED_SHA256="${ICTLOGIN_PYZ_SHA256:-}"
 PREFIX="${ICTLOGIN_PREFIX:-${HOME}/.local/bin}"
+RELEASE_TAG="${ICTLOGIN_RELEASE_TAG:-v0.2.0}"
+RELEASE_BASE_URL="https://gitx.roy1994.top/mancitrus/ictlogin/releases/download/${RELEASE_TAG}"
 
 while [ "$#" -gt 0 ]; do
     case "$1" in
@@ -80,7 +85,8 @@ if [ -z "$SOURCE" ] && [ -z "$URL" ]; then
     elif [ -f "$SCRIPT_DIR/ictlogin.pyz" ]; then
         SOURCE=$SCRIPT_DIR/ictlogin.pyz
     else
-        URL="https://gitx.roy1994.top/mancitrus/ictlogin/raw/branch/main/dist/ictlogin.pyz"
+        URL="${RELEASE_BASE_URL}/ictlogin.pyz"
+        CHECKSUM_URL="${CHECKSUM_URL:-${RELEASE_BASE_URL}/ictlogin.pyz.sha256}"
     fi
 fi
 
@@ -95,20 +101,28 @@ case "$SOURCE" in
 esac
 
 TMP_FILE=$(mktemp "${TMPDIR:-/tmp}/ictlogin.pyz.XXXXXX")
+TMP_CHECKSUM=""
 cleanup() {
     rm -f "$TMP_FILE"
+    [ -z "$TMP_CHECKSUM" ] || rm -f "$TMP_CHECKSUM"
 }
 trap cleanup EXIT HUP INT TERM
 
-if [ -n "$URL" ]; then
+download() {
+    TARGET_FILE=$1
+    SOURCE_URL=$2
     if command -v curl >/dev/null 2>&1; then
-        curl --fail --location --silent --show-error -o "$TMP_FILE" "$URL"
+        curl --fail --location --silent --show-error -o "$TARGET_FILE" "$SOURCE_URL"
     elif command -v wget >/dev/null 2>&1; then
-        wget --quiet --output-document="$TMP_FILE" "$URL"
+        wget --quiet --output-document="$TARGET_FILE" "$SOURCE_URL"
     else
-        echo "curl or wget is required to download $URL" >&2
+        echo "curl or wget is required to download $SOURCE_URL" >&2
         exit 1
     fi
+}
+
+if [ -n "$URL" ]; then
+    download "$TMP_FILE" "$URL"
 else
     cp "$SOURCE_PATH" "$TMP_FILE"
 fi
@@ -117,6 +131,16 @@ if [ -z "$EXPECTED_SHA256" ] && [ -n "$SOURCE_PATH" ] && [ -f "${SOURCE_PATH}.sh
     EXPECTED_SHA256=$(awk 'NF { print $1; exit }' "${SOURCE_PATH}.sha256")
 fi
 
+if [ -z "$EXPECTED_SHA256" ] && [ -n "$CHECKSUM_URL" ]; then
+    TMP_CHECKSUM=$(mktemp "${TMPDIR:-/tmp}/ictlogin.pyz.sha256.XXXXXX")
+    download "$TMP_CHECKSUM" "$CHECKSUM_URL"
+    EXPECTED_SHA256=$(awk 'NF { print $1; exit }' "$TMP_CHECKSUM")
+    if [ -z "$EXPECTED_SHA256" ]; then
+        echo "could not read SHA-256 from $CHECKSUM_URL" >&2
+        exit 1
+    fi
+fi
+
 sha256_file() {
     if command -v sha256sum >/dev/null 2>&1; then
         sha256sum "$1" | awk '{print $1}'