diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2fac671..bb89c49 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,6 +7,9 @@ on:
     tags-ignore:
       - '**'
 
+permissions:
+  contents: read
+
 jobs:
   frontend:
     name: 前端检查 (TypeScript + Lint + Test)
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7411286..931ff90 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,9 +32,9 @@ jobs:
       - name: Tauri Build
         run: npx tauri build
 
-      - name: 上传安装包到 Release
+      - name: 创建 Release 并上传安装包
         run: |
           $installer = Get-ChildItem -Path "src-tauri\target\release\bundle\nsis\*.exe" | Select-Object -First 1
-          gh release upload $env:GITHUB_REF_NAME "$installer" --clobber
+          gh release create $env:GITHUB_REF_NAME "$installer" --title "$env:GITHUB_REF_NAME" --generate-notes
         env:
           GH_TOKEN: ${{ github.token }}