diff --git a/.gitea/workflows/deploy-client.yml b/.gitea/workflows/deploy-client.yml
index 29cb771..3d4b3f5 100644
--- a/.gitea/workflows/deploy-client.yml
+++ b/.gitea/workflows/deploy-client.yml
@@ -113,18 +113,26 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      # 多账号切换(见 docs/ci-multi-account-signing-design.html):从 signing.env
+      # 单源读 SIGNING_ACCOUNT(us|cn),下方按它选账号的证书/ASC 密钥集。
+      - name: Resolve signing account
+        id: acct
+        run: |
+          . scripts/signing.env
+          echo "account=${SIGNING_ACCOUNT:?signing.env 缺 SIGNING_ACCOUNT}" >> "$GITHUB_OUTPUT"
+
       - name: Compile (macOS System Extension app)
         env:
-          # 左=脚本期望的 env 名(勿改),右=实际密钥名。Apple 证书/公证密钥是
-          # 账号级、跨项目唯一 → 放【全局(用户级)密钥】用通用短名,pangolin/jiu 各自
-          # 在此映射到自己脚本的 env。Developer ID Application 证书=站外分发,一张签所有 app。
-          MACOS_DEVELOPER_ID_CERT_P12_BASE64: ${{ secrets.DEVELOPER_ID_P12 }}
-          MACOS_DEVELOPER_ID_CERT_PASSWORD: ${{ secrets.P12_PASSWORD }}
+          # 账号级密钥(Developer ID 证书 + ASC Key,跨该账号所有 app 共享):按
+          # SIGNING_ACCOUNT 选——us→SIGN_US_*(用户级)、cn→旧通用名(用户级,不动、
+          # 供其他 app 继续用)。描述文件是 app 级(绑 bundle id)→ 仓库级,与账号无关。
+          MACOS_DEVELOPER_ID_CERT_P12_BASE64: ${{ steps.acct.outputs.account == 'us' && secrets.SIGN_US_DEVELOPER_ID_P12 || secrets.DEVELOPER_ID_P12 }}
+          MACOS_DEVELOPER_ID_CERT_PASSWORD: ${{ steps.acct.outputs.account == 'us' && secrets.SIGN_US_DEVELOPER_ID_PASSWORD || secrets.P12_PASSWORD }}
+          APPSTORE_API_KEY_ID: ${{ steps.acct.outputs.account == 'us' && secrets.SIGN_US_ASC_KEY_ID || secrets.APPSTORE_API_KEY_ID }}
+          APPSTORE_API_ISSUER_ID: ${{ steps.acct.outputs.account == 'us' && secrets.SIGN_US_ASC_ISSUER_ID || secrets.APPSTORE_API_ISSUER_ID }}
+          APPSTORE_API_KEY_P8_BASE64: ${{ steps.acct.outputs.account == 'us' && secrets.SIGN_US_ASC_KEY_P8 || secrets.APPSTORE_API_KEY_P8_BASE64 }}
           MACOS_APP_PROVISION_PROFILE_BASE64: ${{ secrets.MACOS_APP_PROVISION_PROFILE_BASE64 }}
           MACOS_SYSEXT_PROVISION_PROFILE_BASE64: ${{ secrets.MACOS_SYSEXT_PROVISION_PROFILE_BASE64 }}
-          APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
-          APPSTORE_API_ISSUER_ID: ${{ secrets.APPSTORE_API_ISSUER_ID }}
-          APPSTORE_API_KEY_P8_BASE64: ${{ secrets.APPSTORE_API_KEY_P8_BASE64 }}
           REF_NAME: ${{ gitea.ref_name }}
         run: bash scripts/ci/compile-macos.sh "$REF_NAME"
 
@@ -147,17 +155,23 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Resolve signing account
+        id: acct
+        run: |
+          . scripts/signing.env
+          echo "account=${SIGNING_ACCOUNT:?signing.env 缺 SIGNING_ACCOUNT}" >> "$GITHUB_OUTPUT"
+
       - name: Compile & upload to TestFlight (iOS)
         env:
-          # 证书=账号级 →【全局】通用短名(Apple Distribution 证书,签 iOS App Store/TestFlight);
-          # 描述文件=与 bundle id 绑定 →【项目级】pangolin 仓库密钥。
-          IOS_DIST_CERT_P12_BASE64: ${{ secrets.IOS_DIST_P12 }}
-          IOS_DIST_CERT_PASSWORD: ${{ secrets.IOS_DIST_PASSWORD }}
+          # 账号级(Apple Distribution 证书 + ASC Key)按 SIGNING_ACCOUNT 选;
+          # 描述文件=与 bundle id 绑定 → 仓库级、与账号无关。
+          IOS_DIST_CERT_P12_BASE64: ${{ steps.acct.outputs.account == 'us' && secrets.SIGN_US_APPLE_DIST_P12 || secrets.IOS_DIST_P12 }}
+          IOS_DIST_CERT_PASSWORD: ${{ steps.acct.outputs.account == 'us' && secrets.SIGN_US_APPLE_DIST_PASSWORD || secrets.IOS_DIST_PASSWORD }}
+          APPSTORE_API_KEY_ID: ${{ steps.acct.outputs.account == 'us' && secrets.SIGN_US_ASC_KEY_ID || secrets.APPSTORE_API_KEY_ID }}
+          APPSTORE_API_ISSUER_ID: ${{ steps.acct.outputs.account == 'us' && secrets.SIGN_US_ASC_ISSUER_ID || secrets.APPSTORE_API_ISSUER_ID }}
+          APPSTORE_API_KEY_P8_BASE64: ${{ steps.acct.outputs.account == 'us' && secrets.SIGN_US_ASC_KEY_P8 || secrets.APPSTORE_API_KEY_P8_BASE64 }}
           IOS_APP_PROVISIONING_PROFILE_BASE64: ${{ secrets.IOS_APP_PROVISIONING_PROFILE_BASE64 }}
           IOS_PACKETTUNNEL_PROVISIONING_PROFILE_BASE64: ${{ secrets.IOS_PACKETTUNNEL_PROVISIONING_PROFILE_BASE64 }}
-          APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
-          APPSTORE_API_ISSUER_ID: ${{ secrets.APPSTORE_API_ISSUER_ID }}
-          APPSTORE_API_KEY_P8_BASE64: ${{ secrets.APPSTORE_API_KEY_P8_BASE64 }}
           REF_NAME: ${{ gitea.ref_name }}
         run: bash scripts/ci/compile-ios.sh "$REF_NAME"
       # No artifact upload — compile-ios.sh uploads straight to TestFlight via
diff --git a/scripts/signing.env b/scripts/signing.env
index 068334c..b8c1030 100644
--- a/scripts/signing.env
+++ b/scripts/signing.env
@@ -11,6 +11,12 @@
 # drift 闸:ci/check-codegen-drift.sh 跑 `gen-signing.mjs --check`,防改了 env 没重生成 /
 # 手改了原生标识符。非机密(Team ID / 实体名 / Bundle ID 本就编进产物、公开),入 git。
 
+# 用哪个 Apple 账号的 CI 密钥集(gitea 里 SIGN_<ACCT>_* 的 <ACCT>)。us|cn。
+# 这是 CI 多账号切换的唯一开关:改这行 = 换 CI 用的证书/ASC Key(见
+# docs/ci-multi-account-signing-design.html)。同时下面的 Team/Bundle 等身份也要
+# 一并改成该账号的并跑 gen-signing.mjs——账号密钥与身份必须匹配。
+SIGNING_ACCOUNT="us"
+
 # 10 位 Team ID(developer.apple.com → Membership details)。
 SIGNING_TEAM_ID="44WULXM6SV"