diff --git a/.gitignore b/.gitignore
index 7568856..e01e8ea 100644
--- a/.gitignore
+++ b/.gitignore
@@ -30,3 +30,8 @@ __pycache__/
 # OS
 Thumbs.db
 .DS_Store
+
+# 签名私钥：绝不入库（M255 手册产出的本地副本）
+.signing/
+**/signing-secret*.json
+**/ull-signing/
diff --git a/crates/core/src/update/trust.rs b/crates/core/src/update/trust.rs
index c7aab6a..94f26f7 100644
--- a/crates/core/src/update/trust.rs
+++ b/crates/core/src/update/trust.rs
@@ -60,6 +60,7 @@ pub(crate) struct PinnedKey {
 /// （`packaging/sign_manifest.py --check-pinned-keyring` 按标记解析这一段，标记变了它就找不到表）。
 pub(crate) const PRODUCTION: &[PinnedKey] = &[
     // >>> PINNED-KEYS >>>
+    PinnedKey { key_id: "ull-release", public_key_hex: "1c3687ecd656a29fda87a7afb56e07d2b9e223b62cf3a6f1a901fb499a97b122" },
     // <<< PINNED-KEYS <<<
 ];