diff --git a/.gitea/workflows/docker-build.yml b/.gitea/workflows/docker-build.yml
index b5f3245..eaf337b 100644
--- a/.gitea/workflows/docker-build.yml
+++ b/.gitea/workflows/docker-build.yml
@@ -65,11 +65,22 @@ jobs:
 
       - name: Install minisign
         # 静态二进制直接下载, 免去每次 apt-get update + install
+        # 注意: release tarball 是 macOS 上打包的, 混有多个平台的 minisign 二进制,
+        # 逐个试运行挑出本机可执行的, 都不行再回退 apt
         run: |
           set -euo pipefail
           mkdir -p /tmp/ms
           curl -sL https://github.com/jedisct1/minisign/releases/download/0.12/minisign-0.12-linux.tar.gz | tar xz -C /tmp/ms
-          sudo install -m755 "$(find /tmp/ms -type f -name minisign | head -1)" /usr/local/bin/minisign
+          BIN=""
+          for c in $(find /tmp/ms -type f -name minisign); do
+            if "$c" -v >/dev/null 2>&1; then BIN="$c"; break; fi
+          done
+          if [ -n "$BIN" ]; then
+            sudo install -m755 "$BIN" /usr/local/bin/minisign
+          else
+            echo "未找到可执行的静态二进制, 回退 apt 安装"
+            sudo apt-get update && sudo apt-get install -y minisign
+          fi
           minisign -v
 
       - name: Build & sign OTA package
diff --git a/.gitea/workflows/ota-build.yml b/.gitea/workflows/ota-build.yml
index 9b1185d..cf71028 100644
--- a/.gitea/workflows/ota-build.yml
+++ b/.gitea/workflows/ota-build.yml
@@ -47,11 +47,22 @@ jobs:
 
       - name: Install minisign
         # 静态二进制直接下载, 免去每次 apt-get update + install
+        # 注意: release tarball 是 macOS 上打包的, 混有多个平台的 minisign 二进制,
+        # 逐个试运行挑出本机可执行的, 都不行再回退 apt
         run: |
           set -euo pipefail
           mkdir -p /tmp/ms
           curl -sL https://github.com/jedisct1/minisign/releases/download/0.12/minisign-0.12-linux.tar.gz | tar xz -C /tmp/ms
-          sudo install -m755 "$(find /tmp/ms -type f -name minisign | head -1)" /usr/local/bin/minisign
+          BIN=""
+          for c in $(find /tmp/ms -type f -name minisign); do
+            if "$c" -v >/dev/null 2>&1; then BIN="$c"; break; fi
+          done
+          if [ -n "$BIN" ]; then
+            sudo install -m755 "$BIN" /usr/local/bin/minisign
+          else
+            echo "未找到可执行的静态二进制, 回退 apt 安装"
+            sudo apt-get update && sudo apt-get install -y minisign
+          fi
           minisign -v
 
       - name: Build & sign OTA package