diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 81cfe8de..979a9a90 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -248,9 +248,16 @@ jobs:
           if [ -z "$PKG" ]; then echo "no pkg found, skipping"; exit 0; fi
           xcrun stapler staple "$PKG"
           xcrun stapler validate "$PKG"
-          # P3 终验（rant 验收 + 设计文档 §5.1）：spctl -a 确认 Gatekeeper 接受
+          # P3 终验（rant 验收 + 设计文档 §5.1）：spctl 确认 Gatekeeper 接受
           # （签名 + 公证 + staple 全链路的最终裁决；期望输出 "accepted"）
-          spctl -a -vv "$PKG"
+          # ⚠️ --type install 必需（#477 教训）：spctl 默认类型为 execute，
+          # 对 pkg 评估返回 "no usable signature"（exit 3）——即使 pkg 已用
+          # Developer ID Installer 签名 + 公证 Accepted + staple 成功。
+          # 实测：xcrun stapler staple/validate 均 work，pkgutil --check-signature
+          # 显示 "signed by a developer certificate issued by Apple for distribution"，
+          # 公证 status=Accepted（run 31082935194），但 spctl -a -vv 报
+          # "rejected, source=no usable signature"。加 --type install 后正确评估 pkg。
+          spctl -a -vv --type install "$PKG"
 
       # ── 冒烟（§12，临时 HOME + 无 Python runner）────────────
       - name: Smoke test (R42 temp HOME)