diff --git a/desktop/package.json b/desktop/package.json
index 79c841ba..4d075a15 100644
--- a/desktop/package.json
+++ b/desktop/package.json
@@ -1,7 +1,7 @@
 {
   "name": "claude-code-desktop",
   "private": true,
-  "version": "0.2.4",
+  "version": "0.2.5",
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock
index a8570f02..639f9338 100644
--- a/desktop/src-tauri/Cargo.lock
+++ b/desktop/src-tauri/Cargo.lock
@@ -482,7 +482,7 @@ dependencies = [
 
 [[package]]
 name = "claude-code-desktop"
-version = "0.2.4"
+version = "0.2.5"
 dependencies = [
  "anyhow",
  "portable-pty",
@@ -3704,13 +3704,13 @@ dependencies = [
 
 [[package]]
 name = "serial2"
-version = "0.2.36"
+version = "0.2.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcdbc46aa3882ec3d48ec2b5abcb4f0d863a13d7599265f3faa6d851f23c12f3"
+checksum = "9eb6ea5562eeaed6936b8b54e086aa0f88b9e5b1bef45beb038e2519fa1185b1"
 dependencies = [
  "cfg-if",
  "libc",
- "winapi",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml
index 5b0b1844..ac33cd63 100644
--- a/desktop/src-tauri/Cargo.toml
+++ b/desktop/src-tauri/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "claude-code-desktop"
-version = "0.2.4"
+version = "0.2.5"
 edition = "2021"
 
 [lib]
diff --git a/desktop/src-tauri/tauri.conf.json b/desktop/src-tauri/tauri.conf.json
index a00eb146..49c6c652 100644
--- a/desktop/src-tauri/tauri.conf.json
+++ b/desktop/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/nicegui/nicegui/main/nicegui/static/tauri-schema-v2.json",
   "productName": "Claude Code Haha",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "identifier": "com.claude-code-haha.desktop",
   "build": {
     "frontendDist": "../dist",
diff --git a/release-notes/v0.2.5.md b/release-notes/v0.2.5.md
new file mode 100644
index 00000000..ebc77028
--- /dev/null
+++ b/release-notes/v0.2.5.md
@@ -0,0 +1,30 @@
+# Claude Code Haha v0.2.5
+
+这是一个紧急修复版本，用于临时放行 H5 访问，避免 token 鉴权继续影响聊天使用。
+
+## Highlight
+
+- **临时关闭 H5 token 鉴权**：H5/LAN 访问默认不再要求 `Authorization` header，避免升级后因 token 状态不一致导致聊天或启动失败。
+
+## 问题修复
+
+- 服务端不再因为绑定 `0.0.0.0` 自动开启鉴权；只有显式传入 `--auth-required` 或 `SERVER_AUTH_REQUIRED=1` 时才要求鉴权。
+- 浏览器 H5 启动不再主动读取或校验 H5 token，远程 URL 也会按开放访问路径连接。
+- 设置页先隐藏 H5 启用开关、token 预览/重新生成、允许来源配置，只保留公开 URL 配置和复制入口。
+- CORS 在 H5 token 鉴权暂停期间放行浏览器来源，避免跨来源请求继续卡在预检阶段。
+
+## 验证
+
+- 已新增和更新服务端回归测试，覆盖 REST、WebSocket、CORS 默认无 token 可访问，以及显式鉴权 opt-in 仍然有效。
+- 已更新桌面 H5 启动和设置页测试，覆盖远程 H5 URL 不再要求 token，以及设置页不再展示 token 控件。
+- 已通过 `bun run check:server` 和 `bun run check:desktop`。
+
+## 安装说明
+
+### macOS
+
+首次打开如果提示"已损坏"或"无法验证开发者"，请执行：
+
+```bash
+xattr -cr /Applications/Claude\ Code\ Haha.app
+```