diff --git a/.env.example b/.env.example
index cf3d02d..5a6be57 100644
--- a/.env.example
+++ b/.env.example
@@ -68,3 +68,17 @@ NATIVEPHP_APP_ID=com.codewithdennis.pairframe
 NATIVEPHP_APP_VERSION=1.0.0
 NATIVEPHP_APP_AUTHOR=CodeWithDennis
 NATIVEPHP_APP_DESCRIPTION="NativePHP desktop app to compose light and dark screenshots into split, fade, and patterned thumbnails."
+
+# Auto-updater (production builds only). GitHub Releases provider.
+NATIVEPHP_UPDATER_ENABLED=true
+NATIVEPHP_UPDATER_PROVIDER=github
+GITHUB_OWNER=CodeWithDennis
+GITHUB_REPO=pairframe
+GITHUB_PRIVATE=false
+GITHUB_V_PREFIXED_TAG_NAME=true
+GITHUB_CHANNEL=latest
+GITHUB_RELEASE_TYPE=release
+# Write token for `php artisan native:publish` (CI uses GITHUB_TOKEN).
+GITHUB_TOKEN=
+# Only needed if GITHUB_PRIVATE=true: read-only fine-grained PAT (Contents: Read) embedded in the build.
+GITHUB_AUTOUPDATE_TOKEN=
diff --git a/.github/workflows/native-build.yml b/.github/workflows/native-build.yml
index be5c9ab..a1fc5e0 100644
--- a/.github/workflows/native-build.yml
+++ b/.github/workflows/native-build.yml
@@ -17,26 +17,34 @@ jobs:
   build:
     name: ${{ matrix.label }}
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 60
+    # mac "all" builds arm64 + x64 in one electron-builder run so latest-mac.yml lists both.
+    timeout-minutes: 90
     strategy:
       fail-fast: false
       matrix:
         include:
           - os: macos-latest
             platform: mac
-            arch: arm64
-            label: macOS Apple Silicon
-          - os: macos-latest
-            platform: mac
-            arch: x64
-            label: macOS Intel
+            arch: all
+            label: macOS (arm64 + x64)
           - os: windows-latest
             platform: win
             arch: x64
             label: Windows x64
 
     env:
-      NATIVEPHP_UPDATER_ENABLED: false
+      # Bake GitHub Releases updater into production builds (electron-builder publish config).
+      NATIVEPHP_UPDATER_ENABLED: true
+      NATIVEPHP_UPDATER_PROVIDER: github
+      GITHUB_OWNER: CodeWithDennis
+      GITHUB_REPO: pairframe
+      GITHUB_PRIVATE: false
+      GITHUB_V_PREFIXED_TAG_NAME: true
+      GITHUB_CHANNEL: latest
+      GITHUB_RELEASE_TYPE: release
+      # Do not set GITHUB_TOKEN / GH_TOKEN here: builds use native:build (not --publish).
+      # A write token in the build env risks ending up in updater/publish metadata.
+      # Unsigned CI builds until Apple / Windows signing secrets are configured.
       CSC_IDENTITY_AUTO_DISCOVERY: false
 
     steps:
@@ -76,7 +84,18 @@ jobs:
             VERSION="0.0.0-dev"
           fi
 
-          echo "NATIVEPHP_APP_VERSION=${VERSION}" >> .env
+          {
+            echo "NATIVEPHP_APP_VERSION=${VERSION}"
+            echo "NATIVEPHP_UPDATER_ENABLED=true"
+            echo "NATIVEPHP_UPDATER_PROVIDER=github"
+            echo "GITHUB_OWNER=CodeWithDennis"
+            echo "GITHUB_REPO=pairframe"
+            echo "GITHUB_PRIVATE=false"
+            echo "GITHUB_V_PREFIXED_TAG_NAME=true"
+            echo "GITHUB_CHANNEL=latest"
+            echo "GITHUB_RELEASE_TYPE=release"
+          } >> .env
+
           echo "Building Pairframe ${VERSION} for ${{ matrix.platform }}-${{ matrix.arch }}"
 
       # Do not use --publish: NativePHP's electronPath($subpath) resolves published
diff --git a/README.md b/README.md
index b9b6de9..835e951 100644
--- a/README.md
+++ b/README.md
@@ -17,6 +17,15 @@ Prebuilt macOS and Windows installers are available on the [GitHub Releases](htt
 
 Alternatively, skip the release binaries and [build the app yourself locally](#build-locally) — that does not require changing privacy settings for a downloaded installer.
 
+### Auto-updates
+
+Production builds ship with the NativePHP / electron-updater client pointed at GitHub Releases.
+
+- **Windows:** updates can work without code signing (SmartScreen may still warn).
+- **macOS:** automatic updates only work for **signed and notarized** builds. Unsigned CI builds still need a manual download from Releases.
+- Existing installs from before the updater was enabled need **one manual update**; later versions update themselves.
+- Public GitHub Releases need no client token. If the repo were private again, set `GITHUB_PRIVATE=true` and a read-only `GITHUB_AUTOUPDATE_TOKEN` secret.
+
 ## Requirements
 
 - PHP 8.3+
diff --git a/config/nativephp.php b/config/nativephp.php
index 852addb..976abaf 100644
--- a/config/nativephp.php
+++ b/config/nativephp.php
@@ -99,26 +99,27 @@
          * updater will only work when your application is bundled
          * for production.
          */
-        'enabled' => env('NATIVEPHP_UPDATER_ENABLED', true),
+        'enabled' => filter_var(env('NATIVEPHP_UPDATER_ENABLED', true), FILTER_VALIDATE_BOOLEAN),
 
         /**
          * The updater provider to use.
          * Supported: "github", "s3", "spaces"
          * Note: The "s3" provider is compatible with S3-compatible services like Cloudflare R2.
          */
-        'default' => env('NATIVEPHP_UPDATER_PROVIDER', 'spaces'),
+        'default' => env('NATIVEPHP_UPDATER_PROVIDER', 'github'),
 
         'providers' => [
             'github' => [
                 'driver' => 'github',
-                'repo' => env('GITHUB_REPO'),
-                'owner' => env('GITHUB_OWNER'),
+                'repo' => env('GITHUB_REPO', 'pairframe'),
+                'owner' => env('GITHUB_OWNER', 'CodeWithDennis'),
                 'token' => env('GITHUB_TOKEN'),
-                'vPrefixedTagName' => env('GITHUB_V_PREFIXED_TAG_NAME', true),
-                'private' => env('GITHUB_PRIVATE', false),
+                'vPrefixedTagName' => filter_var(env('GITHUB_V_PREFIXED_TAG_NAME', true), FILTER_VALIDATE_BOOLEAN),
+                // Public releases: no client token needed. Set true + GITHUB_AUTOUPDATE_TOKEN only if the repo is private.
+                'private' => filter_var(env('GITHUB_PRIVATE', false), FILTER_VALIDATE_BOOLEAN),
                 'autoupdate_token' => env('GITHUB_AUTOUPDATE_TOKEN'), // Read-only token used by the updater for private repos
                 'channel' => env('GITHUB_CHANNEL', 'latest'),
-                'releaseType' => env('GITHUB_RELEASE_TYPE', 'draft'),
+                'releaseType' => env('GITHUB_RELEASE_TYPE', 'release'),
             ],
 
             's3' => [
@@ -128,7 +129,7 @@
                 'region' => env('AWS_DEFAULT_REGION'),
                 'bucket' => env('AWS_BUCKET'),
                 'endpoint' => env('AWS_ENDPOINT'),
-                'path' => env('NATIVEPHP_UPDATER_PATH', null),
+                'path' => env('NATIVEPHP_UPDATER_PATH'),
                 /**
                  * Optional public URL for serving updates (e.g., CDN or custom domain).
                  * When set, updates will be downloaded from this URL instead of the S3 endpoint.
@@ -144,7 +145,7 @@
                 'secret' => env('DO_SPACES_SECRET_ACCESS_KEY'),
                 'name' => env('DO_SPACES_NAME'),
                 'region' => env('DO_SPACES_REGION'),
-                'path' => env('NATIVEPHP_UPDATER_PATH', null),
+                'path' => env('NATIVEPHP_UPDATER_PATH'),
             ],
         ],
     ],
@@ -184,5 +185,5 @@
     /**
      * Custom PHP binary path.
      */
-    'binary_path' => env('NATIVEPHP_PHP_BINARY_PATH', null),
+    'binary_path' => env('NATIVEPHP_PHP_BINARY_PATH'),
 ];