diff --git a/.github/workflows/reusable-release-skill.yaml b/.github/workflows/reusable-release-skill.yaml
index 519430f..f7a6b1a 100644
--- a/.github/workflows/reusable-release-skill.yaml
+++ b/.github/workflows/reusable-release-skill.yaml
@@ -23,6 +23,10 @@ on:
         required: false
         type: string
         default: https://jc2009.com/api/artifacts/prune-old-versions
+    secrets:
+      # Base64 of official pyarmor-regfile-*.zip — trial mode still allows only one obfuscated script per CI run.
+      PYARMOR_REG_B64:
+        required: false
 
 jobs:
   build-and-deploy:
@@ -34,11 +38,21 @@ jobs:
     steps:
       - uses: http://120.25.191.12:3000/admin/actions-checkout@v4
 
-      # Pin PyArmor 8.5.3 — PyArmor 9.x trial hits "out of license" on multi-file gen in CI.
+      # Pin PyArmor 8.5.3 — matches desktop bundles; 9.x trial is stricter in CI.
       - name: Setup Tools
         run: pip install "pyarmor==8.5.3" requests python-frontmatter --break-system-packages -i https://pypi.tuna.tsinghua.edu.cn/simple
 
-      # One script per pyarmor invocation (same pattern as desktop tooling); avoids trial limits on batch gen.
+      - name: Register PyArmor (optional)
+        env:
+          PYARMOR_REG_B64: ${{ secrets.PYARMOR_REG_B64 }}
+        run: |
+          if [ -z "${PYARMOR_REG_B64}" ]; then
+            echo "PyArmor: no PYARMOR_REG_B64 secret — trial mode (fails if scripts/*.py has more than one file)."
+          else
+            python -c "import os,base64,pathlib,subprocess; p=pathlib.Path('/tmp/pyarmor-reg.zip'); p.write_bytes(base64.standard_b64decode(os.environ['PYARMOR_REG_B64'])); subprocess.run(['pyarmor','reg',str(p)],check=True); p.unlink(missing_ok=True)"
+          fi
+
+      # One script per pyarmor invocation (matches common desktop usage).
       - name: Encrypt Source Code
         run: |
           mkdir -p dist/package