diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c429f42..2b3e62c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -198,7 +198,7 @@ jobs:
           npm_config_target_arch: ${{ matrix.arch }}
         run: pnpm build:mac --${{ matrix.arch }}
       - name: Generate checksums
-        run: pnpm checksum .dmg .zip
+        run: pnpm checksum .dmg
       - name: Upload Artifacts
         if: startsWith(github.ref, 'refs/heads/')
         uses: actions/upload-artifact@v4
@@ -207,7 +207,6 @@ jobs:
           path: |
             dist/*.sha256
             dist/*.dmg
-            dist/*.zip
           if-no-files-found: error
       - name: Publish Release
         if: startsWith(github.ref, 'refs/tags/v')
@@ -216,7 +215,6 @@ jobs:
           files: |
             dist/*.sha256
             dist/*.dmg
-            dist/*.zip
           body_path: changelog.md
           token: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/changelog.md b/changelog.md
index 1c7174d..486ed97 100644
--- a/changelog.md
+++ b/changelog.md
@@ -1,8 +1,3 @@
-### Features
-
-- 支持在特定WiFi SSID下直连
-- 支持同步运行时配置到GitHub Gist
-
 ### Bug Fixes
 
-- 修复某些mac无法开启开机启动的问题
+- 修复macOS应用内更新后权限丢失的问题
diff --git a/electron-builder.yml b/electron-builder.yml
index 1ce5eae..d8a83fb 100644
--- a/electron-builder.yml
+++ b/electron-builder.yml
@@ -40,7 +40,6 @@ nsis:
 mac:
   target:
     - dmg
-    - zip
   entitlementsInherit: build/entitlements.mac.plist
   extendInfo:
     - NSCameraUsageDescription: Application requests access to the device's camera.
diff --git a/src/main/resolve/autoUpdater.ts b/src/main/resolve/autoUpdater.ts
index 6039e20..980e7d8 100644
--- a/src/main/resolve/autoUpdater.ts
+++ b/src/main/resolve/autoUpdater.ts
@@ -2,7 +2,7 @@ import axios from 'axios'
 import yaml from 'yaml'
 import { app } from 'electron'
 import { getControledMihomoConfig } from '../config'
-import { dataDir, exeDir, isPortable, resourcesFilesDir } from '../utils/dirs'
+import { dataDir, exeDir, exePath, isPortable, resourcesFilesDir } from '../utils/dirs'
 import { rm, writeFile } from 'fs/promises'
 import path from 'path'
 import { existsSync } from 'fs'
@@ -39,8 +39,8 @@ export async function downloadAndInstallUpdate(version: string): Promise<void> {
     'win32-x64': `mihomo-party-windows-${version}-x64-setup.exe`,
     'win32-ia32': `mihomo-party-windows-${version}-ia32-setup.exe`,
     'win32-arm64': `mihomo-party-windows-${version}-arm64-setup.exe`,
-    'darwin-x64': `mihomo-party-macos-${version}-x64.zip`,
-    'darwin-arm64': `mihomo-party-macos-${version}-arm64.zip`
+    'darwin-x64': `mihomo-party-macos-${version}-x64.dmg`,
+    'darwin-arm64': `mihomo-party-macos-${version}-arm64.dmg`
   }
   let file = fileMap[`${process.platform}-${process.arch}`]
   if (isPortable()) {
@@ -84,9 +84,22 @@ export async function downloadAndInstallUpdate(version: string): Promise<void> {
       ).unref()
       app.quit()
     }
-    if (file.endsWith('.zip')) {
+    if (file.endsWith('.dmg')) {
       const execPromise = promisify(exec)
-      await execPromise(`unzip -o -K '${path.join(dataDir(), file)}' -d /Applications`)
+      const name = exePath().split('.app')[0].replace('/Applications/', '')
+      await execPromise(
+        `hdiutil attach "${path.join(dataDir(), file)}" -mountpoint "/Volumes/mihomo-party" -nobrowse`
+      )
+      try {
+        await execPromise(`mv /Applications/${name}.app /tmp`)
+        await execPromise('cp -R "/Volumes/mihomo-party/mihomo-party.app" /Applications/')
+        await execPromise(`rm -rf /tmp/${name}.app`)
+      } catch (e) {
+        await execPromise(`mv /tmp/${name}.app /Applications`)
+        throw e
+      } finally {
+        await execPromise('hdiutil detach "/Volumes/mihomo-party"')
+      }
       app.relaunch()
       app.quit()
     }
diff --git a/src/main/utils/init.ts b/src/main/utils/init.ts
index e128a61..453f9c9 100644
--- a/src/main/utils/init.ts
+++ b/src/main/utils/init.ts
@@ -105,7 +105,7 @@ async function cleanup(): Promise<void> {
   // update cache
   const files = await readdir(dataDir())
   for (const file of files) {
-    if (file.endsWith('.exe') || file.endsWith('.dmg') || file.endsWith('.zip')) {
+    if (file.endsWith('.exe') || file.endsWith('.dmg')) {
       try {
         await rm(path.join(dataDir(), file))
       } catch {