diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml
index aaa20cb..9338fc5 100644
--- a/.github/workflows/pr-build.yml
+++ b/.github/workflows/pr-build.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: macos-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Select Xcode
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5deab05..1ee1bfb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
     steps:
       # --- 0. 准备工作 ---
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Select Xcode
         run: |
@@ -201,7 +201,10 @@ jobs:
           VERSION=${{ steps.version.outputs.version }}
           DMG_NAME="${APP_NAME}-v${VERSION}.dmg"
 
-          cp -R "$APP_PATH" "./${APP_NAME}.app"
+          DMG_STAGING="dmg-staging"
+          rm -rf "$DMG_STAGING"
+          mkdir -p "$DMG_STAGING"
+          ditto "$APP_PATH" "$DMG_STAGING/${APP_NAME}.app"
 
           create-dmg \
             --volname "${APP_NAME}" \
@@ -212,10 +215,12 @@ jobs:
             --hide-extension "${APP_NAME}.app" \
             --app-drop-link 450 200 \
             "$DMG_NAME" \
-            "./${APP_NAME}.app"
+            "$DMG_STAGING/${APP_NAME}.app"
 
           codesign --force --sign "$CERT_NAME" "$DMG_NAME"
 
+          rm -rf "$DMG_STAGING"
+
           echo "DMG_NAME=$DMG_NAME" >> $GITHUB_ENV
 
       # --- 7b. DMG 公证 ---
@@ -255,10 +260,12 @@ jobs:
           VERSION=${{ steps.version.outputs.version }}
           ZIP_NAME="${APP_NAME}-v${VERSION}.app.zip"
 
-          # 复制到当前目录再压缩，保留 .app 层级
-          cp -R "$APP_PATH" "./${APP_NAME}.app"
-          ditto -c -k --sequesterRsrc --keepParent "./${APP_NAME}.app" "$ZIP_NAME"
-          rm -rf "./${APP_NAME}.app"
+          ZIP_STAGING="zip-staging"
+          rm -rf "$ZIP_STAGING"
+          mkdir -p "$ZIP_STAGING"
+          ditto "$APP_PATH" "$ZIP_STAGING/${APP_NAME}.app"
+          ditto -c -k --sequesterRsrc --keepParent "$ZIP_STAGING/${APP_NAME}.app" "$ZIP_NAME"
+          rm -rf "$ZIP_STAGING"
 
           SHA256=$(shasum -a 256 "$ZIP_NAME" | awk '{print $1}')
           printf '%s  %s\n' "$SHA256" "$ZIP_NAME" > "${ZIP_NAME}.sha256"
diff --git a/FinderSyncExt/FinderSyncExt.entitlements b/FinderSyncExt/FinderSyncExt.entitlements
index 7a99def..9818f2d 100644
--- a/FinderSyncExt/FinderSyncExt.entitlements
+++ b/FinderSyncExt/FinderSyncExt.entitlements
@@ -2,6 +2,8 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
+	<key>com.apple.security.app-sandbox</key>
+	<true/>
 	<key>com.apple.security.application-groups</key>
 	<array>
 		<string>group.cn.wflixu.RClick</string>
diff --git a/FinderSyncExt/FinderSyncExt.swift b/FinderSyncExt/FinderSyncExt.swift
index f1bb52d..da4e327 100644
--- a/FinderSyncExt/FinderSyncExt.swift
+++ b/FinderSyncExt/FinderSyncExt.swift
@@ -280,6 +280,7 @@ class FinderSyncExt: FIFinderSync, @unchecked Sendable {
                 }
                 let actionsItem = NSMenuItem(title: actionsTitle, action: nil, keyEquivalent: "")
                 actionsItem.submenu = actionsSubMenu
+                actionsItem.image = templateSymbol("ellipsis.circle")
                 menu.addItem(actionsItem)
             } else {
                 // 不折叠：直接显示菜单项
@@ -310,6 +311,7 @@ class FinderSyncExt: FIFinderSync, @unchecked Sendable {
                 }
                 let appsItem = NSMenuItem(title: appsTitle, action: nil, keyEquivalent: "")
                 appsItem.submenu = appsSubMenu
+                appsItem.image = templateSymbol("square.and.arrow.up.on.square")
                 menu.addItem(appsItem)
             } else {
                 // 不折叠：直接显示菜单项
diff --git a/RClick.xcodeproj/project.pbxproj b/RClick.xcodeproj/project.pbxproj
index fc532ad..aa327f6 100644
--- a/RClick.xcodeproj/project.pbxproj
+++ b/RClick.xcodeproj/project.pbxproj
@@ -552,7 +552,7 @@
 				CODE_SIGN_ENTITLEMENTS = RClick/RClickDebug.entitlements;
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 20260704002;
+				CURRENT_PROJECT_VERSION = 20260705001;
 				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_TEAM = 4L3563XCBN;
 				ENABLE_APP_SANDBOX = YES;
@@ -568,7 +568,7 @@
 					"@executable_path/../Frameworks",
 				);
 				MACOSX_DEPLOYMENT_TARGET = 15.6;
-				MARKETING_VERSION = 2.0.3;
+				MARKETING_VERSION = 2.0.4;
 				PRODUCT_BUNDLE_IDENTIFIER = cn.wflixu.RClick;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				REGISTER_APP_GROUPS = YES;
@@ -590,7 +590,7 @@
 				CODE_SIGN_ENTITLEMENTS = RClick/RClick.entitlements;
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 20260704002;
+				CURRENT_PROJECT_VERSION = 20260705001;
 				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_TEAM = 4L3563XCBN;
 				ENABLE_APP_SANDBOX = YES;
@@ -606,7 +606,7 @@
 					"@executable_path/../Frameworks",
 				);
 				MACOSX_DEPLOYMENT_TARGET = 15.6;
-				MARKETING_VERSION = 2.0.3;
+				MARKETING_VERSION = 2.0.4;
 				PRODUCT_BUNDLE_IDENTIFIER = cn.wflixu.RClick;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				REGISTER_APP_GROUPS = YES;
@@ -669,7 +669,7 @@
 				CODE_SIGN_ENTITLEMENTS = FinderSyncExt/FinderSyncExt.entitlements;
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 20260704002;
+				CURRENT_PROJECT_VERSION = 20260705001;
 				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_TEAM = 4L3563XCBN;
 				ENABLE_APP_SANDBOX = YES;
@@ -685,7 +685,7 @@
 					"@executable_path/../../../../Frameworks",
 				);
 				MACOSX_DEPLOYMENT_TARGET = 15.6;
-				MARKETING_VERSION = 2.0.3;
+				MARKETING_VERSION = 2.0.4;
 				PRODUCT_BUNDLE_IDENTIFIER = cn.wflixu.RClick.FinderSyncExt;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				REGISTER_APP_GROUPS = YES;
@@ -704,7 +704,7 @@
 				CODE_SIGN_ENTITLEMENTS = FinderSyncExt/FinderSyncExt.entitlements;
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 20260704002;
+				CURRENT_PROJECT_VERSION = 20260705001;
 				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_TEAM = 4L3563XCBN;
 				ENABLE_APP_SANDBOX = YES;
@@ -720,7 +720,7 @@
 					"@executable_path/../../../../Frameworks",
 				);
 				MACOSX_DEPLOYMENT_TARGET = 15.6;
-				MARKETING_VERSION = 2.0.3;
+				MARKETING_VERSION = 2.0.4;
 				PRODUCT_BUNDLE_IDENTIFIER = cn.wflixu.RClick.FinderSyncExt;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				REGISTER_APP_GROUPS = YES;