diff --git a/release.js b/release.js
index c95baa5..e64265f 100644
--- a/release.js
+++ b/release.js
@@ -243,6 +243,20 @@ async function main() {
     console.log('Uploading update-payload.zip...');
     const payloadUrl = await uploadFileToGitLabPackage(payloadPath, 'vyla-home', version, `update-payload-${timestamp}.zip`);
 
+    const manifestData = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    for (const [name, c] of Object.entries(manifestData.components || {})) {
+        console.log(`Uploading ${c.file}...`);
+        c.url = await uploadFileToGitLabPackage(path.join(__dirname, 'release-assets', c.file), 'vyla-home', version, `${name}-${timestamp}.zip`);
+    }
+
+    const signingKeyPem = process.env.VYLA_UPDATE_SIGNING_KEY;
+    if (!signingKeyPem) {
+        throw new Error('VYLA_UPDATE_SIGNING_KEY is required to sign the update manifest.');
+    }
+    delete manifestData.signature;
+    manifestData.signature = crypto.sign(null, Buffer.from(UpdateClient.canonicalManifest(manifestData)), signingKeyPem.replace(/\\n/g, '\n')).toString('base64');
+    fs.writeFileSync(manifestPath, JSON.stringify(manifestData, null, 2), 'utf8');
+
     console.log('Uploading manifest.json...');
     const manifestUrl = await uploadFileToGitLabPackage(manifestPath, 'vyla-home', version, `manifest-${timestamp}.json`);
 
@@ -251,13 +265,6 @@ async function main() {
         { name: 'manifest.json', url: manifestUrl, link_type: 'other' }
     ];
 
-    const manifestData = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
-    for (const [name, c] of Object.entries(manifestData.components || {})) {
-        console.log(`Uploading ${c.file}...`);
-        const componentUrl = await uploadFileToGitLabPackage(path.join(__dirname, 'release-assets', c.file), 'vyla-home', version, `${name}-${timestamp}.zip`);
-        releaseLinks.push({ name: c.file, url: componentUrl, link_type: 'other' });
-    }
-
     if (installerPath && installerUploadName) {
         console.log(`Uploading installer ${installerUploadName}...`);
         const ext = path.extname(installerUploadName);
diff --git a/update-client.js b/update-client.js
index d08c621..a4cd6a9 100644
--- a/update-client.js
+++ b/update-client.js
@@ -380,10 +380,14 @@ class UpdateClient {
     const components = {};
     for (const [name, c] of Object.entries(manifest.components)) {
       const link = links.find((a) => a.name === c.file);
-      if (!link) {
+      const direct = typeof c.url === 'string' &&
+        c.url.startsWith('https://gitlab.com/api/v4/projects/') &&
+        c.url.includes('/packages/generic/vyla-home/');
+      const url = direct ? c.url : (link && link.url);
+      if (!url) {
         throw new Error(`Release is missing asset ${c.file}.`);
       }
-      components[name] = { url: link.url, sha256: c.sha256, id: c.id, size: c.size };
+      components[name] = { url, sha256: c.sha256, id: c.id, size: c.size };
     }
 
     let installer = null;