diff --git a/README.en.md b/README.en.md
index 8d9d0ab..a5406ac 100644
--- a/README.en.md
+++ b/README.en.md
@@ -42,17 +42,21 @@ All nine built-in channels can send JPEG, PNG, and WebP images, plus GIFs sent a
 
 ## Installation
 
-```sh
-npx -y github:xmanrui/dsh-im install
-```
-
-Alternatively, install it directly from npm:
+Install the published stable release from npm (recommended):
 
 ```sh
 dsh plugin --profile web add @xmanrui/dsh-im
 ```
 
-Restart `dsh web`, then open **Settings → Plugins → IM Bot**. The installer replaces directly installed `dsh-feishu`, `dsh-weixin`, and `dsh-dingtalk` entries in the profile with `dsh-im` without deleting channel data.
+Restart `dsh web`, then open **Settings → Plugins → IM Bot**.
+
+To try the latest code before it is published to npm, use the GitHub-source installer instead:
+
+```sh
+npx -y github:xmanrui/dsh-im install
+```
+
+A GitHub-source installation fetches and builds a Git dependency directly. With pnpm 10 or newer, the profile may first need an `allowBuilds` entry in `pnpm-workspace.yaml`. Most users should prefer the stable npm release. The GitHub installer replaces directly installed `dsh-feishu`, `dsh-weixin`, and `dsh-dingtalk` entries in the profile with `dsh-im` without deleting channel data.
 
 Feishu, QQ, DingTalk, and WeCom each provide two entry points. The blue **QR access** action uses the platform QR flow; the key-marked, outlined **Manual access** action immediately to its right connects an existing bot application. Feishu and QQ use App ID + App Secret and AppID + AppSecret respectively, DingTalk uses Client ID + Client Secret, and WeCom uses Bot ID + Secret. Secrets are sent only to the local Harness Host and stored through its protected credential provider; status responses and bot lists never return them.
 
diff --git a/README.md b/README.md
index 593ae54..eab170f 100644
--- a/README.md
+++ b/README.md
@@ -45,17 +45,21 @@ Connect IM bots to DeepSeek Harness by scanning a QR code, using an App Manifest
 
 ## 安装
 
-```sh
-npx -y github:xmanrui/dsh-im install
-```
-
-也可以直接从 npm 安装：
+推荐从 npm 安装已发布的稳定版本：
 
 ```sh
 dsh plugin --profile web add @xmanrui/dsh-im
 ```
 
-重启 `dsh web`，然后打开「设置 → 插件 → IM机器人」。安装器会用 `dsh-im` 替换 profile 中直接安装的 `dsh-feishu`、`dsh-weixin` 和 `dsh-dingtalk`，但不删除任何渠道数据；原有渠道凭据和扫码绑定会继续使用。
+重启 `dsh web`，然后打开「设置 → 插件 → IM机器人」。
+
+如需试用尚未发布到 npm 的最新代码，可以改用 GitHub 源安装器：
+
+```sh
+npx -y github:xmanrui/dsh-im install
+```
+
+GitHub 源安装会直接拉取并构建 Git 依赖；pnpm 10 及以上版本可能要求先在 profile 的 `pnpm-workspace.yaml` 中允许该依赖执行构建脚本。普通用户建议优先使用 npm 稳定版。GitHub 安装器会用 `dsh-im` 替换 profile 中直接安装的 `dsh-feishu`、`dsh-weixin` 和 `dsh-dingtalk`，但不删除任何渠道数据；原有渠道凭据和扫码绑定会继续使用。
 
 飞书、QQ、钉钉和企业微信页面都提供两种入口：带二维码图标的蓝色「扫码接入机器人」按钮走平台官方扫码流程，右侧带钥匙图标的白色描边「手动接入」按钮连接已经创建的机器人应用。飞书和 QQ 分别填写 App ID + App Secret、AppID + AppSecret；钉钉填写官方 Client ID + Client Secret；企业微信填写官方 Bot ID + Secret。Secret 只提交给本机 Harness Host，并写入受保护的凭据存储；状态接口和机器人列表不会回传 Secret。