diff --git a/.SRCINFO b/.SRCINFO
index d79cadc..71f7ee6 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,7 +1,7 @@
 pkgbase = grok-bot-bin
 	pkgdesc = Grok Bot desktop agent (official .deb repackaged)
 	pkgver = 0.35.0
-	pkgrel = 2
+	pkgrel = 1
 	url = https://cursor.com/download/bot
 	arch = x86_64
 	license = LicenseRef-proprietary
@@ -30,6 +30,6 @@ pkgbase = grok-bot-bin
 	source = grok-bot-launch.sh
 	noextract = grok-bot_0.35.0_amd64.deb
 	sha256sums = ed254e819d0f0419a1df9771009363074f65f80d8175d2ee0fc62900087ebd99
-	sha256sums = ed254e819d0f0419a1df9771009363074f65f80d8175d2ee0fc62900087ebd99
+	sha256sums = 886c8b55eb44d2f7812be50dcc1571907dc2d7e755171e67e916f497634f09eb
 
 pkgname = grok-bot-bin
diff --git a/PKGBUILD b/PKGBUILD
index 3163959..ccbb92c 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -10,7 +10,7 @@
 pkgname=grok-bot-bin
 pkgver=0.35.0
 _commit=1c5a6ceb364c4dd53f0069f72cc4239220ed471e
-pkgrel=2
+pkgrel=1
 pkgdesc="Grok Bot desktop agent (official .deb repackaged)"
 arch=('x86_64')
 url="https://cursor.com/download/bot"
@@ -42,8 +42,8 @@ source=(
   "grok-bot-launch.sh"
 )
 noextract=("grok-bot_${pkgver}_amd64.deb")
-sha256sums=('ed254e819d0f0419a1df9771009363074f65f80d8175d2ee0fc62900087ebd99')
-  'fb888b2204c8a51c71a9f5f9a2913ac10561f3ef6939c1245ecae4e837d4ada2'
+sha256sums=(
+  'ed254e819d0f0419a1df9771009363074f65f80d8175d2ee0fc62900087ebd99'
   '886c8b55eb44d2f7812be50dcc1571907dc2d7e755171e67e916f497634f09eb'
 )
 
diff --git a/scripts/update.sh b/scripts/update.sh
index 246ffb6..70ef8a9 100755
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -23,20 +23,51 @@ deb_url="https://downloads.cursor.com/grokbot/stable/${commit}/linux/x64/grok-bo
 tmp=$(mktemp)
 trap 'rm -f "$tmp"' EXIT
 curl -fsSL --retry 3 "$deb_url" -o "$tmp"
-sha=$(sha256sum "$tmp" | cut -d' ' -f1)
+deb_sha=$(sha256sum "$tmp" | cut -d' ' -f1)
+shim_sha=$(sha256sum grok-bot-launch.sh | cut -d' ' -f1)
 
+# Reset pkgrel on upstream version bumps.
 sed -i \
   -e "s/^pkgver=.*/pkgver=${version}/" \
   -e "s/^_commit=.*/_commit=${commit}/" \
-  -e "s/^sha256sums=.*/sha256sums=('${sha}')/" \
+  -e "s/^pkgrel=.*/pkgrel=1/" \
   PKGBUILD
 
-# Refresh .SRCINFO source URL + hashes without requiring makepkg.
-sed -i \
-  -e "s/^\\tpkgver = .*/\\tpkgver = ${version}/" \
-  -e "s#^\\tsource = https://downloads.cursor.com/grokbot/stable/.*/linux/x64/grok-bot_.*_amd64.deb#\\tsource = https://downloads.cursor.com/grokbot/stable/${commit}/linux/x64/grok-bot_${version}_amd64.deb#" \
-  -e "s/^\\tnoextract = grok-bot_.*_amd64.deb/\\tnoextract = grok-bot_${version}_amd64.deb/" \
-  -e "s/^\\tsha256sums = .*/\\tsha256sums = ${sha}/" \
-  .SRCINFO
+python3 - "$deb_sha" "$shim_sha" <<'PY'
+import pathlib, re, sys
+deb_sha, shim_sha = sys.argv[1], sys.argv[2]
+p = pathlib.Path("PKGBUILD")
+text = p.read_text()
+block = f"sha256sums=(\n  '{deb_sha}'\n  '{shim_sha}'\n)"
+text2, n = re.subn(r"sha256sums=\([^\)]*\)", block, text, count=1, flags=re.S)
+if n != 1:
+    raise SystemExit(f"sha256sums replace failed (n={n})")
+p.write_text(text2)
+PY
 
-echo "Updated PKGBUILD and .SRCINFO to ${version} sha256=${sha}"
+python3 - "$version" "$commit" "$deb_sha" "$shim_sha" <<'PY'
+import pathlib, re, sys
+version, commit, deb_sha, shim_sha = sys.argv[1:5]
+p = pathlib.Path(".SRCINFO")
+lines = []
+saw_sha = False
+for line in p.read_text().splitlines(True):
+    if line.startswith("\tpkgver ="):
+        lines.append(f"\tpkgver = {version}\n"); continue
+    if line.startswith("\tpkgrel ="):
+        lines.append("\tpkgrel = 1\n"); continue
+    if line.startswith("\tsource = https://downloads.cursor.com/grokbot/stable/"):
+        lines.append(f"\tsource = https://downloads.cursor.com/grokbot/stable/{commit}/linux/x64/grok-bot_{version}_amd64.deb\n"); continue
+    if line.startswith("\tnoextract = grok-bot_"):
+        lines.append(f"\tnoextract = grok-bot_{version}_amd64.deb\n"); continue
+    if line.startswith("\tsha256sums ="):
+        if not saw_sha:
+            lines.append(f"\tsha256sums = {deb_sha}\n")
+            lines.append(f"\tsha256sums = {shim_sha}\n")
+            saw_sha = True
+        continue
+    lines.append(line)
+p.write_text("".join(lines))
+PY
+
+echo "Updated PKGBUILD and .SRCINFO to ${version} deb_sha=${deb_sha} shim_sha=${shim_sha}"