diff --git a/scripts/ci/android-signing.sh b/scripts/ci/android-signing.sh
index dd31437..071627a 100644
--- a/scripts/ci/android-signing.sh
+++ b/scripts/ci/android-signing.sh
@@ -109,4 +109,42 @@ print('[signing] build.gradle.kts 已注入 import + signingConfigs + release si
 PYEOF
 fi
 
+# --- 4. 放行明文 HTTP (release APK 默认拦截 http://, 而服务器仅支持 HTTP) ---
+# Tauri 模板默认 debug=true, release=false。Android 9+ 会拦截 release 的所有 http:// 明文请求
+# 导致 Failed to fetch。这里把 release 的 usesCleartextTraffic 改为 "true"。
+# 幂等: 第二次运行时模板已被改为 "true", 替换无 false 可改, 也不会重复注入。
+if [ ! -f "$APP_GRADLE" ]; then
+  echo "[signing] ERROR: 找不到 $APP_GRADLE (明文放行跳过)" >&2
+  exit 1
+fi
+
+python3 - "$APP_GRADLE" <<'PYEOF'
+import sys, re
+
+path = sys.argv[1]
+src = open(path, encoding='utf-8').read()
+
+# 1) 把显式的 usesCleartextTraffic = "false" 全部改为 "true"
+new = re.sub(
+    r'(manifestPlaceholders\["usesCleartextTraffic"\]\s*=\s*)"false"',
+    r'\1"true"',
+    src,
+)
+
+# 2) 若模板根本没有 usesCleartextTraffic 配置, 则在 release 构建块内注入一行 true
+if 'usesCleartextTraffic' not in src:
+    m = re.search(r'^([ \t]*)getByName\("release"\)\s*\{', new, flags=re.M)
+    if not m:
+        m = re.search(r'^([ \t]*)release\s*\{', new, flags=re.M)
+    if m:
+        inner = m.group(1) + '    '
+        inject = f'\n{inner}manifestPlaceholders["usesCleartextTraffic"] = "true"'
+        new = new.replace(m.group(0), m.group(0) + inject, 1)
+    else:
+        print('[signing] 警告: 未找到 release 构建块, 明文放行注入跳过', file=sys.stderr)
+
+open(path, 'w', encoding='utf-8').write(new)
+print('[signing] usesCleartextTraffic 已设为 true (release 放行明文 HTTP)')
+PYEOF
+
 echo "[signing] 完成: keystore.properties 已写, build.gradle.kts 已注入"