diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 353b871..16d0c08 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ on:
 
 env:
   NODE_VERSION: "25"
-  CRONET_GO_VERSION: "2faf34666c2cc8234f10f2ab6d4c4d6104d34ae2"
+  CRONET_GO_VERSION: "2fef65f9dba90ddb89a87d00a6eb6165487c10c1"
   CRONET_GO_REPO: https://github.com/sagernet/cronet-go.git
   BOOTLIN_BASE_URL: https://toolchains.bootlin.com/downloads/releases/toolchains
 
diff --git a/.github/workflows/sync-upstream.yml b/.github/workflows/sync-upstream.yml
new file mode 100644
index 0000000..8664ca1
--- /dev/null
+++ b/.github/workflows/sync-upstream.yml
@@ -0,0 +1,63 @@
+name: Sync upstream
+
+on:
+  schedule:
+    # 每天北京时间 04:00 同步（UTC 20:00）
+    - cron: '0 20 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: sync-upstream
+  cancel-in-progress: false
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout fork
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Configure git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Add upstream remote
+        run: |
+          git remote add upstream https://github.com/alireza0/s-ui.git
+          git fetch upstream main
+
+      - name: Sync main from upstream
+        run: |
+          set -euo pipefail
+
+          # Preserve fork workflows. GITHUB_TOKEN cannot push commits that
+          # create/update workflow files from upstream (for example docker.yml).
+          tmp_workflows="$(mktemp -d)"
+          if [ -d .github/workflows ]; then
+            cp -a .github/workflows/. "$tmp_workflows/"
+          fi
+
+          # Make the fork match upstream exactly, avoiding merge/rebase conflicts
+          # from divergent local history.
+          git checkout main
+          git reset --hard upstream/main
+
+          rm -rf .github/workflows
+          mkdir -p .github/workflows
+          cp -a "$tmp_workflows/." .github/workflows/
+          git add .github/workflows
+
+          if git diff --cached --quiet; then
+            echo "Fork is already in sync with upstream."
+            exit 0
+          fi
+
+          git commit -m "Sync upstream and keep fork workflow"
+          git push --force-with-lease origin main
\ No newline at end of file