diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 32accab..8552293 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -1,16 +1,12 @@
 name: Release
 
 # Triggered when a v* tag is pushed: creates the Gitea Release entry with notes
-# from CHANGELOG.md, builds the CLI (Linux x86_64 and aarch64) and the desktop
-# app (Linux aarch64, Linux x86_64, and Windows via cargo-xwin cross-compilation),
-# and generates the latest.json manifest read by the desktop updater.
+# from CHANGELOG.md and uploads the compiled CLI (scripts/package-cli.sh) with
+# a .sha256 checksum alongside each archive, plus the desktop bundles (Linux
+# aarch64, Linux x86_64, and Windows via cargo-xwin).
 #
 # No macOS: Tauri requires Apple's SDK and code-signing hardware/account, which
 # this Linux ARM64 runner does not have.
-#
-# Required repository/user secrets: GUARA_TAURI_SIGNING_PRIVATE_KEY and
-# GUARA_TAURI_SIGNING_PRIVATE_KEY_PASSWORD (sign updater bundles). Unprefixed
-# secret names remain supported as fallback.
 on:
   push:
     tags: ['v*']
@@ -50,22 +46,22 @@ jobs:
   cli:
     name: CLI (${{ matrix.platform }})
     needs: release
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.runner }}
     env:
       CARGO_TARGET_DIR: /opt/hostedtoolcache/cargo-target/guara-release-cli-${{ matrix.platform }}
     strategy:
       fail-fast: false
       matrix:
         include:
-          - { platform: linux-aarch64, target: aarch64-unknown-linux-gnu, apt: "" }
-          - { platform: linux-x86_64, target: x86_64-unknown-linux-gnu, apt: "gcc-x86-64-linux-gnu" }
+          - { platform: linux-aarch64, target: aarch64-unknown-linux-gnu, apt: "", runner: linux-arm64 }
+          - { platform: linux-x86_64, target: x86_64-unknown-linux-gnu, apt: "gcc-x86-64-linux-gnu", runner: linux-amd64 }
     steps:
       - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}
       - name: Platform cross-linker
-        if: ${{ matrix.apt != '' }}
+        if: ${{ matrix.apt != '' && matrix.runner != 'linux-amd64' }}
         run: scripts/apt-install.sh /opt/hostedtoolcache/apt-cache/cli-x86_64 ${{ matrix.apt }}
       - name: Build and package
         run: scripts/package-cli.sh "${{ gitea.ref_name }}" "${{ matrix.platform }}" "${{ matrix.target }}" | tee packages.txt
@@ -78,15 +74,16 @@ jobs:
   gui:
     name: Desktop app (${{ matrix.platform }})
     needs: release
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.runner }}
     env:
       CARGO_TARGET_DIR: /opt/hostedtoolcache/cargo-target/guara-release-gui-${{ matrix.platform }}
-      TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.GUARA_TAURI_SIGNING_PRIVATE_KEY || secrets.TAURI_SIGNING_PRIVATE_KEY }}
-      TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.GUARA_TAURI_SIGNING_PRIVATE_KEY_PASSWORD || secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
     strategy:
       fail-fast: false
       matrix:
-        platform: [linux-aarch64, linux-x86_64, windows]
+        include:
+          - { platform: linux-aarch64, runner: linux-arm64 }
+          - { platform: linux-x86_64, runner: linux-amd64 }
+          - { platform: windows, runner: linux-amd64 }
     steps:
       - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
@@ -129,23 +126,3 @@ jobs:
           TOKEN: ${{ gitea.token }}
           API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
         run: scripts/release-upload.sh "${{ gitea.ref_name }}" dist-gui/*
-
-  updater:
-    name: Build latest.json
-    needs: gui
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - name: latest.json
-        env:
-          TAG: ${{ gitea.ref_name }}
-          TOKEN: ${{ gitea.token }}
-          API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
-        run: |
-          scripts/release-notes.sh "$TAG" > notes.md
-          python3 scripts/make-latest-json.py "$TAG" notes.md latest.json
-      - name: Upload to release
-        env:
-          TOKEN: ${{ gitea.token }}
-          API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
-        run: scripts/release-upload.sh "${{ gitea.ref_name }}" latest.json