diff --git a/console/pnpm-workspace.yaml b/console/pnpm-workspace.yaml
index e348897..bbcd2f8 100644
--- a/console/pnpm-workspace.yaml
+++ b/console/pnpm-workspace.yaml
@@ -1,5 +1,10 @@
-onlyBuiltDependencies:
-  - electron
-  - electron-winstaller
+# pnpm 11 把「允许运行安装脚本的依赖」改名为 allowBuilds（列表形式的
+# onlyBuiltDependencies 会被静默忽略，导致 ERR_PNPM_IGNORED_BUILDS 让 pnpm run 直接失败）。
+allowBuilds:
+  electron: true
+  electron-winstaller: true
 overrides:
+  # app-builder-lib@26.15.3 声明的是 ^3.0.0，但它 import 的 ElectronDownloadCacheMode
+  # 只有 3.1.0 才导出，不钉死会在 pnpm run dist 时抛
+  # TypeError: Cannot read properties of undefined (reading 'ReadWrite')。
   "@electron/get": 3.1.0
diff --git a/deploy/build.bat b/deploy/build.bat
index fc6d22b..e6a7722 100644
--- a/deploy/build.bat
+++ b/deploy/build.bat
@@ -52,7 +52,10 @@ node deploy\prepare-extra.mjs || exit /b 1
 cd console
 REM pnpm 11 blocks postinstall by default (ERR_PNPM_IGNORED_BUILDS), so the electron
 REM runtime binary is fetched explicitly below instead of relying on the install script.
-call pnpm install --frozen-lockfile --ignore-scripts || exit /b 1
+REM console\pnpm-workspace.yaml 里的 allowBuilds 已经放行 electron 的安装脚本，
+REM 因此这里不再加 --ignore-scripts（否则 pnpm run 的依赖校验会以
+REM ERR_PNPM_IGNORED_BUILDS 失败）。
+call pnpm install --frozen-lockfile || exit /b 1
 call :ensure_electron || exit /b 1
 call pnpm run dist || exit /b 1
 cd ..
@@ -65,7 +68,7 @@ dir /b dist\console
 endlocal
 exit /b 0
 
-REM ---- ensure the electron runtime binary is present (pnpm skips its postinstall) --
+REM ---- ensure the electron runtime binary is present (fallback for mirror failures) --
 :ensure_electron
 REM path.txt tells the electron package where the binary is; without it
 REM electron-builder tries to download the runtime and hits a Node 24 bug.