diff --git a/apps/desktop/scripts/macos/pkg_arm64.sh b/apps/desktop/scripts/macos/pkg_arm64.sh
index 04f9e104..5a397e6b 100755
--- a/apps/desktop/scripts/macos/pkg_arm64.sh
+++ b/apps/desktop/scripts/macos/pkg_arm64.sh
@@ -132,6 +132,10 @@ find "${APP_BUNDLE}" -name '._*' -delete
 
 echo ".app created successfully."
 
+mkdir -p build_pkg_scripts
+cp "${SCRIPT_DIR}/tcc_postinstall.sh" build_pkg_scripts/postinstall
+chmod +x build_pkg_scripts/postinstall
+
 mkdir -p build_pkg_resources
 cat > build_pkg_resources/welcome.html <<EOF
 <!doctype html>
@@ -161,6 +165,7 @@ cat > build_pkg_resources/welcome.html <<EOF
     <h1>欢迎安装 ${INSTALLER_TITLE}</h1>
     <p>CrossDesk 将安装到“应用程序”文件夹。</p>
     <p>首次启动时，CrossDesk 会引导你在系统设置中授予必要权限，包括辅助功能、录屏与系统录音等。</p>
+    <p>为避免旧版本授权残留造成状态误判，安装后可能需要重新授权。</p>
     <p>安装完成后，请从“应用程序”文件夹启动 CrossDesk。</p>
 </body>
 </html>
@@ -172,6 +177,7 @@ pkgbuild \
   --version "${APP_VERSION}" \
   --install-location "/Applications" \
   --component "${APP_BUNDLE}" \
+  --scripts build_pkg_scripts \
   build_pkg_temp/${APP_NAME}-component.pkg
 
 cat > build_pkg_temp/Distribution <<EOF
@@ -244,7 +250,7 @@ APPLESCRIPT
 fi
 echo "Set icon finished"
 
-rm -rf build_pkg_temp build_pkg_resources "${APP_BUNDLE}"
+rm -rf build_pkg_temp build_pkg_scripts build_pkg_resources "${APP_BUNDLE}"
 
 echo "PKG package created successfully."
 echo "installer ${PKG_NAME}"
diff --git a/apps/desktop/scripts/macos/pkg_x64.sh b/apps/desktop/scripts/macos/pkg_x64.sh
index 1aee41ca..f74761e7 100755
--- a/apps/desktop/scripts/macos/pkg_x64.sh
+++ b/apps/desktop/scripts/macos/pkg_x64.sh
@@ -132,6 +132,10 @@ find "${APP_BUNDLE}" -name '._*' -delete
 
 echo ".app created successfully."
 
+mkdir -p build_pkg_scripts
+cp "${SCRIPT_DIR}/tcc_postinstall.sh" build_pkg_scripts/postinstall
+chmod +x build_pkg_scripts/postinstall
+
 mkdir -p build_pkg_resources
 cat > build_pkg_resources/welcome.html <<EOF
 <!doctype html>
@@ -161,6 +165,7 @@ cat > build_pkg_resources/welcome.html <<EOF
     <h1>欢迎安装 ${INSTALLER_TITLE}</h1>
     <p>CrossDesk 将安装到“应用程序”文件夹。</p>
     <p>首次启动时，CrossDesk 会引导你在系统设置中授予必要权限，包括辅助功能、录屏与系统录音等。</p>
+    <p>为避免旧版本授权残留造成状态误判，安装后可能需要重新授权。</p>
     <p>安装完成后，请从“应用程序”文件夹启动 CrossDesk。</p>
 </body>
 </html>
@@ -172,6 +177,7 @@ pkgbuild \
   --version "${APP_VERSION}" \
   --install-location "/Applications" \
   --component "${APP_BUNDLE}" \
+  --scripts build_pkg_scripts \
   build_pkg_temp/${APP_NAME}-component.pkg
 
 cat > build_pkg_temp/Distribution <<EOF
@@ -244,7 +250,7 @@ APPLESCRIPT
 fi
 echo "Set icon finished"
 
-rm -rf build_pkg_temp build_pkg_resources "${APP_BUNDLE}"
+rm -rf build_pkg_temp build_pkg_scripts build_pkg_resources "${APP_BUNDLE}"
 
 echo "PKG package created successfully."
 echo "installer ${PKG_NAME}"
diff --git a/apps/desktop/scripts/macos/tcc_postinstall.sh b/apps/desktop/scripts/macos/tcc_postinstall.sh
new file mode 100644
index 00000000..a0ee7054
--- /dev/null
+++ b/apps/desktop/scripts/macos/tcc_postinstall.sh
@@ -0,0 +1,112 @@
+#!/bin/bash
+set -e
+
+APP_IDENTIFIER="cn.crossdesk.app"
+
+# Keep known historical identifiers here. tccutil only resets identifiers that
+# Launch Services can currently resolve, so path/db cleanup below remains a
+# best-effort fallback for stale entries from unsigned or removed builds.
+BUNDLE_IDENTIFIERS=(
+    "cn.crossdesk.app"
+    "cn.crossdesk.CrossDesk"
+    "com.crossdesk.app"
+    "com.crossdesk.CrossDesk"
+    "com.kunkundi.crossdesk"
+    "com.kunkundi.CrossDesk"
+)
+
+TCC_SERVICES=(
+    "ScreenCapture"
+    "Accessibility"
+    "Microphone"
+    "AudioCapture"
+)
+
+run_tccutil() {
+    local user_name="$1"
+    local user_id="$2"
+    local service="$3"
+    local bundle_id="$4"
+
+    if [ -n "$user_name" ] && [ -n "$user_id" ]; then
+        /bin/launchctl asuser "$user_id" \
+            /usr/bin/sudo -u "$user_name" \
+            /usr/bin/tccutil reset "$service" "$bundle_id" >/dev/null 2>&1
+    else
+        /usr/bin/tccutil reset "$service" "$bundle_id" >/dev/null 2>&1
+    fi
+}
+
+reset_bundle_tcc() {
+    local user_name="$1"
+    local user_id="$2"
+    local bundle_id
+    local service
+
+    for bundle_id in "${BUNDLE_IDENTIFIERS[@]}"; do
+        if run_tccutil "$user_name" "$user_id" "All" "$bundle_id"; then
+            continue
+        fi
+
+        for service in "${TCC_SERVICES[@]}"; do
+            run_tccutil "$user_name" "$user_id" "$service" "$bundle_id" || true
+        done
+    done
+}
+
+cleanup_tcc_db() {
+    local db_path="$1"
+
+    if [ ! -f "$db_path" ] || ! command -v sqlite3 >/dev/null 2>&1; then
+        return
+    fi
+
+    /usr/bin/sqlite3 "$db_path" <<'SQL' >/dev/null 2>&1 || true
+DELETE FROM access
+WHERE service IN (
+  'kTCCServiceScreenCapture',
+  'kTCCServiceAccessibility',
+  'kTCCServiceMicrophone',
+  'kTCCServiceAudioCapture'
+)
+AND (
+  client IN (
+    'cn.crossdesk.app',
+    'cn.crossdesk.CrossDesk',
+    'com.crossdesk.app',
+    'com.crossdesk.CrossDesk',
+    'com.kunkundi.crossdesk',
+    'com.kunkundi.CrossDesk'
+  )
+  OR lower(client) LIKE '%crossdesk%'
+);
+SQL
+}
+
+cleanup_user_tcc_db() {
+    local user_name="$1"
+    local home_dir
+
+    home_dir=$(/usr/bin/dscl . -read "/Users/${user_name}" NFSHomeDirectory 2>/dev/null |
+        /usr/bin/awk '{print $2}')
+    if [ -z "$home_dir" ]; then
+        return
+    fi
+
+    cleanup_tcc_db "${home_dir}/Library/Application Support/com.apple.TCC/TCC.db"
+}
+
+CONSOLE_USER=$(/usr/bin/stat -f "%Su" /dev/console 2>/dev/null || true)
+if [ -n "$CONSOLE_USER" ] &&
+   [ "$CONSOLE_USER" != "root" ] &&
+   [ "$CONSOLE_USER" != "loginwindow" ]; then
+    CONSOLE_UID=$(/usr/bin/id -u "$CONSOLE_USER" 2>/dev/null || true)
+    reset_bundle_tcc "$CONSOLE_USER" "$CONSOLE_UID"
+    cleanup_user_tcc_db "$CONSOLE_USER"
+fi
+
+# Also clear any system/root-scoped decisions as a harmless fallback.
+reset_bundle_tcc "" ""
+cleanup_tcc_db "/Library/Application Support/com.apple.TCC/TCC.db"
+
+exit 0