diff --git a/apps/desktop/src-tauri/src/main.rs b/apps/desktop/src-tauri/src/main.rs
index 6f78b534..4ac04b6f 100644
--- a/apps/desktop/src-tauri/src/main.rs
+++ b/apps/desktop/src-tauri/src/main.rs
@@ -120,7 +120,9 @@ fn main() {
         .plugin(tauri_plugin_notification::init())
         .plugin(tauri_plugin_opener::init())
         // The WebView receives no updater capability. Native commands below
-        // expose the fixed, stateful operations owned by Desktop Update.
+        // expose the fixed, stateful operations owned by Desktop Update. The
+        // plugin's required static config deliberately has no usable key;
+        // each check builds an updater from compiled Release/Recovery trust.
         .plugin(tauri_plugin_updater::Builder::new().build())
         .setup(|app| {
             let app_local_data = app.path().app_local_data_dir()?;
diff --git a/apps/desktop/src-tauri/tauri.conf.json b/apps/desktop/src-tauri/tauri.conf.json
index 19534153..07819dc8 100644
--- a/apps/desktop/src-tauri/tauri.conf.json
+++ b/apps/desktop/src-tauri/tauri.conf.json
@@ -35,5 +35,13 @@
       "icons/icon.icns",
       "icons/icon.ico"
     ]
+  },
+  "plugins": {
+    "updater": {
+      "pubkey": "",
+      "windows": {
+        "installMode": "passive"
+      }
+    }
   }
 }
diff --git a/apps/desktop/src-tauri/tauri.updater-artifacts.conf.json b/apps/desktop/src-tauri/tauri.updater-artifacts.conf.json
index 41aa155a..d50663db 100644
--- a/apps/desktop/src-tauri/tauri.updater-artifacts.conf.json
+++ b/apps/desktop/src-tauri/tauri.updater-artifacts.conf.json
@@ -2,12 +2,5 @@
   "$schema": "https://schema.tauri.app/config/2",
   "bundle": {
     "createUpdaterArtifacts": true
-  },
-  "plugins": {
-    "updater": {
-      "windows": {
-        "installMode": "passive"
-      }
-    }
   }
 }