diff --git a/.gitignore b/.gitignore
index 4415f5f..ae27296 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,6 +13,7 @@ rules/*
 
 # 内部署名（构建期注入，绝不进仓库）
 deploy/signature.local.txt
+deploy/signature.build.txt
 # 安装器许可页的署名文本（构建时生成）
 console/resources/installer-signature.nsh
 
diff --git a/deploy/build.bat b/deploy/build.bat
index bda250f..4b39bd1 100644
--- a/deploy/build.bat
+++ b/deploy/build.bat
@@ -30,13 +30,16 @@ echo === [3/4] server build ===
 cd server
 if not exist ..\dist mkdir ..\dist
 REM internal signature is injected from a machine-local file (gitignored, never in repo).
-REM set /p returns empty under chcp 65001, so read the first line with for /f instead.
-REM PowerShell reads the file as text and strips a BOM; for /f file-read does not.
+REM set /p returns empty under chcp 65001; PowerShell piping re-encodes the text and
+REM corrupts non-ASCII. So a Node script normalizes it (BOM/whitespace stripped) into
+REM deploy\signature.build.txt, and for /f reads that file directly (no re-encoding).
+node ..\deploy\prepare-signature.mjs || exit /b 1
 set "INTERNAL_SIGNATURE="
-if exist "..\deploy\signature.local.txt" for /f "usebackq delims= eol=" %%A in (`powershell -NoProfile -Command "Get-Content -LiteralPath '..\deploy\signature.local.txt' -TotalCount 1"`) do if not defined INTERNAL_SIGNATURE set "INTERNAL_SIGNATURE=%%A"
+if exist "..\deploy\signature.build.txt" for /f "usebackq delims= eol=" %%A in ("..\deploy\signature.build.txt") do if not defined INTERNAL_SIGNATURE set "INTERNAL_SIGNATURE=%%A"
 if defined INTERNAL_SIGNATURE (
   REM single quotes keep spaces inside the value intact for go's ldflags parser
   go build -ldflags "-X 'git.yeij.top/AskaEth/Scoreboard/server/internal/version.InternalSignature=%INTERNAL_SIGNATURE%'" -o ..\dist\scoreboard.exe . || exit /b 1
+  findstr /m /c:"%INTERNAL_SIGNATURE%" ..\dist\scoreboard.exe >nul || echo   [warn] signature NOT found in exe
   echo   internal signature injected
 ) else (
   go build -o ..\dist\scoreboard.exe . || exit /b 1
diff --git a/deploy/prepare-signature.mjs b/deploy/prepare-signature.mjs
new file mode 100644
index 0000000..d643aaa
--- /dev/null
+++ b/deploy/prepare-signature.mjs
@@ -0,0 +1,26 @@
+// 把构建机本地署名规范化成一份纯文本，供 build.bat 用 for /f 直接读文件。
+//
+// 为什么不用 PowerShell 管道：PowerShell 5.1 的 Get-Content 默认按系统 ANSI 码页读，
+// 输出再经 cmd（chcp 65001）解码一次，中文会被转成乱码——曾导致日志写着
+// "internal signature injected"，但 exe 里的字节和预期对不上。
+// 用 Node 读 UTF-8 再写回，同时剥掉可能的 BOM 与首尾空白，保证注入值稳定。
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+
+const root = dirname(import.meta.dirname)
+const src = join(root, 'deploy', 'signature.local.txt')
+const dst = join(root, 'deploy', 'signature.build.txt')
+
+if (!existsSync(src)) {
+  console.log('  no internal signature file')
+  process.exit(0)
+}
+
+const first = readFileSync(src, 'utf8').replace(/^\uFEFF/, '').split(/\r?\n/, 1)[0].trim()
+if (first === '') {
+  console.log('  internal signature file is empty')
+  process.exit(0)
+}
+
+writeFileSync(dst, first, 'utf8')
+console.log('  internal signature normalized')