diff --git a/electron.vite.config.ts b/electron.vite.config.ts
index b5f47f5..7dec5d1 100644
--- a/electron.vite.config.ts
+++ b/electron.vite.config.ts
@@ -2,9 +2,18 @@ import { resolve } from 'node:path'
 import { defineConfig, externalizeDepsPlugin } from 'electron-vite'
 import react from '@vitejs/plugin-react'
 
+// Bake the Gitea update token into the main bundle at build time so
+// electron-updater can fetch latest.yml from the private repo. The token
+// only needs read access to releases. Falls back to empty string if not set
+// (dev/local builds), in which case auto-update is silently disabled.
+const updateToken = JSON.stringify(process.env.UPDATE_TOKEN ?? '')
+
 export default defineConfig({
   main: {
     plugins: [externalizeDepsPlugin()],
+    define: {
+      __UPDATE_TOKEN__: updateToken
+    },
     resolve: {
       alias: {
         '@shared': resolve('src/shared')
diff --git a/package.json b/package.json
index 6282581..b5b41ca 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "laude",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Exercise reminder — Windows desktop app",
   "main": "out/main/index.js",
   "author": "AnRil",
diff --git a/src/main/updater.ts b/src/main/updater.ts
index c364e50..976f4ef 100644
--- a/src/main/updater.ts
+++ b/src/main/updater.ts
@@ -3,6 +3,10 @@ import { autoUpdater } from 'electron-updater'
 import { IPC } from '@shared/ipc'
 import type { UpdaterStatus } from '@shared/types'
 
+// Build-time defined in electron.vite.config.ts.
+// Read-only Gitea token, used to fetch latest.yml from the private repo.
+declare const __UPDATE_TOKEN__: string
+
 let currentStatus: UpdaterStatus = { kind: 'idle' }
 let wired = false
 let checkInterval: NodeJS.Timeout | null = null
@@ -38,6 +42,14 @@ export function initUpdater(): void {
   autoUpdater.autoInstallOnAppQuit = true
   autoUpdater.allowDowngrade = false
 
+  // Gitea private-repo release assets require a token in Authorization
+  // header — without it Gitea responds 404 (not 401) on download URLs.
+  if (typeof __UPDATE_TOKEN__ === 'string' && __UPDATE_TOKEN__.length > 0) {
+    autoUpdater.requestHeaders = {
+      Authorization: `token ${__UPDATE_TOKEN__}`
+    }
+  }
+
   autoUpdater.on('checking-for-update', () => setStatus({ kind: 'checking' }))
 
   autoUpdater.on('update-available', (info) => {