diff --git a/bin/omarchy-cn-doctor b/bin/omarchy-cn-doctor
index 8580d237..2ea96404 100755
--- a/bin/omarchy-cn-doctor
+++ b/bin/omarchy-cn-doctor
@@ -69,6 +69,27 @@ check_mirror() {
   fi
 }
 
+# refresh-pacman restores the checkout's template, which on overlay installs
+# has no OmarchyCN mirror line; this check makes that loss visible and fixable
+check_omarchy_repo() {
+  local conf="${OMARCHYCN_PACMAN_CONF:-/etc/pacman.conf}"
+
+  if ! grep -q "^Server = https://pkgs.omarchy.org/stable/" "$conf"; then
+    echo "INFO omarchy-repo: 非 stable 通道，跳过 OmarchyCN 镜像检查"
+    return 0
+  fi
+  if cn_mirror_omarchy_repo_ok; then
+    echo "PASS omarchy-repo: OmarchyCN 镜像行在位"
+    return 0
+  fi
+  if [[ $fix == "true" ]] && cn_mirror_omarchy_repo_fix && cn_mirror_omarchy_repo_ok; then
+    echo "PASS omarchy-repo: 已重新插入 OmarchyCN 镜像行"
+    return 0
+  fi
+  echo "FAIL omarchy-repo: [omarchy] 缺 OmarchyCN 镜像行（omarchycn doctor mirror --fix 可修复）"
+  failures=$((failures + 1))
+}
+
 check_dev_mirror() {
   omarchy-cn-dev-mirror-doctor || failures=$((failures + 1))
 }
@@ -79,12 +100,16 @@ check_ime() {
 
 case "$module" in
 network) check_network ;;
-mirror) check_mirror ;;
+mirror)
+  check_mirror
+  check_omarchy_repo
+  ;;
 dev-mirror) check_dev_mirror ;;
 ime) check_ime ;;
 all)
   check_network
   check_mirror
+  check_omarchy_repo
   check_dev_mirror
   check_ime
   ;;
diff --git a/cn/lib/mirror.sh b/cn/lib/mirror.sh
index 3db2e965..60bb724b 100644
--- a/cn/lib/mirror.sh
+++ b/cn/lib/mirror.sh
@@ -4,6 +4,19 @@
 CN_MIRRORS_JSON="$OMARCHY_PATH/cn/mirrors.json"
 CN_MIRRORLIST="/etc/pacman.d/mirrorlist"
 CN_PROFILE_FILE="$HOME/.config/omarchycn/mirror-profile"
+CN_OMARCHY_MIRROR="https://git.zacharyzhang.com/api/packages/ZacharyZhang-NY/arch/omarchy/x86_64"
+
+# [omarchy] mirror line management (stable channel only); shared by the
+# rollout migration and doctor --fix so refresh-pacman resets stay healable
+cn_mirror_omarchy_repo_ok() {
+  grep -qxF "Server = $CN_OMARCHY_MIRROR" "${OMARCHYCN_PACMAN_CONF:-/etc/pacman.conf}"
+}
+
+cn_mirror_omarchy_repo_fix() {
+  local conf="${OMARCHYCN_PACMAN_CONF:-/etc/pacman.conf}"
+  cn_mirror_omarchy_repo_ok && return 0
+  sudo sed -i "s|^Server = https://pkgs.omarchy.org/stable/|Server = $CN_OMARCHY_MIRROR\nServer = https://pkgs.omarchy.org/stable/|" "$conf"
+}
 
 cn_mirror_ids() {
   jq -r '.mirrors[].id' "$CN_MIRRORS_JSON"
diff --git a/cn/migrations/1787861071.sh b/cn/migrations/1787861071.sh
new file mode 100644
index 00000000..33dd3a32
--- /dev/null
+++ b/cn/migrations/1787861071.sh
@@ -0,0 +1,8 @@
+echo "Trust the OmarchyCN registry key and put the [omarchy] mirror first"
+
+sudo pacman-key --add "$OMARCHY_PATH/cn/keys/omarchycn-registry.asc"
+sudo pacman-key --lsign-key 74DCF57ACD812B24D959F146BD386048867B33B4
+
+# Only the stable channel is mirrored; edge/rc systems keep upstream directly
+source "$OMARCHY_PATH/cn/lib/mirror.sh"
+cn_mirror_omarchy_repo_fix
diff --git a/default/pacman/pacman-stable.conf b/default/pacman/pacman-stable.conf
index 5dafbc84..4d375bf2 100644
--- a/default/pacman/pacman-stable.conf
+++ b/default/pacman/pacman-stable.conf
@@ -27,4 +27,6 @@ Include = /etc/pacman.d/mirrorlist
 
 [omarchy]
 SigLevel = Optional TrustAll
+# OmarchyCN mirror first (registry-signed db, key via cn/keys), upstream fallback
+Server = https://git.zacharyzhang.com/api/packages/ZacharyZhang-NY/arch/omarchy/x86_64
 Server = https://pkgs.omarchy.org/stable/$arch
diff --git a/install/post-install/pacman.sh b/install/post-install/pacman.sh
index 23580b3c..5c882ff1 100644
--- a/install/post-install/pacman.sh
+++ b/install/post-install/pacman.sh
@@ -3,6 +3,10 @@
 cp -f "$OMARCHY_PATH/default/pacman/pacman-${OMARCHY_MIRROR:-stable}.conf" /etc/pacman.conf
 cp -f "$OMARCHY_PATH/default/pacman/mirrorlist-${OMARCHY_MIRROR:-stable}" /etc/pacman.d/mirrorlist
 
+# The [omarchy] mirror db is signed by the OmarchyCN registry key
+pacman-key --add "$OMARCHY_PATH/cn/keys/omarchycn-registry.asc"
+pacman-key --lsign-key 74DCF57ACD812B24D959F146BD386048867B33B4
+
 # omarchy-settings skips this override until cups-browsed is actually present
 # to avoid pacman creating cups-browsed.conf.pacnew during ISO package install.
 if [[ -f $OMARCHY_PATH/etc-overrides/cups-cups-browsed.conf && -d /etc/cups ]]; then