diff --git a/bin/omarchy-cn-app-install b/bin/omarchy-cn-app-install
index ad386f2e..9eefcb13 100755
--- a/bin/omarchy-cn-app-install
+++ b/bin/omarchy-cn-app-install
@@ -32,10 +32,15 @@ fi
 
 case "$source_type" in
 aur)
-  # Offline installs ship no sync db; yay then treats repo deps as AUR
+  # Offline installs ship no sync db; yay then treats repo deps as AUR.
+  # System upgrades must go through the omarchy-update pipeline (pacman guard).
   if ! compgen -G "/var/lib/pacman/sync/*.db" > /dev/null; then
-    echo "首次安装：正在同步软件仓库并更新系统（pacman -Syu）……"
-    sudo pacman -Syu --noconfirm
+    if [[ ! -t 0 ]]; then
+      echo "首次安装应用前请先完成一次系统更新: omarchy-update" >&2
+      exit 1
+    fi
+    echo "首次安装应用前需要完成一次系统更新。"
+    omarchy-update
   fi
   omarchy-pkg-aur-add "$(jq -r '.package' <<<"$entry")"
   ;;
diff --git a/bin/omarchy-cn-kimi-install b/bin/omarchy-cn-kimi-install
old mode 100644
new mode 100755