diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index f2337ff..476fe96 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -12,6 +12,7 @@ jobs:
     env:
       BINARY_NAME: email-mcp
       BUILD_PATH: build/email-mcp-linux-amd64
+      CHECKSUM_PATH: build/email-mcp-linux-amd64.sha256
       MANIFEST_PATH: mcp.toml
 
     steps:
@@ -28,6 +29,14 @@ jobs:
       - name: Build linux amd64 binary
         run: make build GOOS=linux GOARCH=amd64
 
+      - name: Generate binary checksum
+        run: |
+          set -euo pipefail
+
+          asset_name="$(basename "${BUILD_PATH}")"
+          checksum_value="$(sha256sum "${BUILD_PATH}" | cut -d' ' -f1)"
+          printf '%s  %s\n' "${checksum_value}" "${asset_name}" > "${CHECKSUM_PATH}"
+
       - name: Generate release notes
         id: release_notes
         env:
@@ -165,3 +174,30 @@ jobs:
             cat asset.json >&2
             exit 1
           fi
+
+      - name: Upload checksum asset
+        env:
+          REPOSITORY: ${{ github.repository }}
+          API_URL: ${{ github.api_url }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          RELEASE_ID: ${{ steps.release.outputs.release_id }}
+        run: |
+          set -euo pipefail
+
+          owner="${REPOSITORY%%/*}"
+          repo="${REPOSITORY#*/}"
+          asset_name="$(basename "${CHECKSUM_PATH}")"
+          upload_url="${API_URL}/repos/${owner}/${repo}/releases/${RELEASE_ID}/assets?name=${asset_name}"
+
+          http_code="$(curl -sS -o asset.json -w '%{http_code}' \
+            -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/octet-stream" \
+            --data-binary @"${CHECKSUM_PATH}" \
+            "${upload_url}")"
+
+          if [ "${http_code}" -lt 200 ] || [ "${http_code}" -ge 300 ]; then
+            echo "asset upload failed with status ${http_code}" >&2
+            cat asset.json >&2
+            exit 1
+          fi
diff --git a/README.md b/README.md
index 3e0a177..3255ac5 100644
--- a/README.md
+++ b/README.md
@@ -110,15 +110,20 @@ credentials not configured; run `email-mcp setup`
 ./email-mcp update
 ```
 
-Le manifeste de ce repo pointe vers l’endpoint Gitea :
+Le manifeste de ce repo utilise le driver Gitea du framework :
 
 ```toml
 binary_name = "email-mcp"
 
 [update]
 source_name = "email-mcp releases"
+driver = "gitea"
+repository = "AI/email-mcp"
 base_url = "https://gitea.lclr.dev"
-latest_release_url = "https://gitea.lclr.dev/api/v1/repos/AI/email-mcp/releases/latest"
+asset_name_template = "{binary}-{os}-{arch}{ext}"
+checksum_asset_name = "{asset}.sha256"
+checksum_required = true
+token_env_names = ["GITEA_TOKEN"]
 ```
 
 ## Diagnostic
@@ -173,6 +178,7 @@ Une release est générée automatiquement quand tu pousses un tag `v*` sur le r
 Les assets publiés sont :
 
 - `build/email-mcp-linux-amd64`
+- `build/email-mcp-linux-amd64.sha256`
 - `mcp.toml`
 
 ## Compiler depuis les sources
diff --git a/internal/cli/app_test.go b/internal/cli/app_test.go
index 891f118..da09164 100644
--- a/internal/cli/app_test.go
+++ b/internal/cli/app_test.go
@@ -705,8 +705,9 @@ func TestAppRunUpdateLoadsManifestNearExecutable(t *testing.T) {
 	if err := os.WriteFile(filepath.Join(tempDir, "mcp.toml"), []byte(`
 [update]
 source_name = "test"
+driver = "gitea"
+repository = "AI/email-mcp"
 base_url = "http://127.0.0.1:1"
-latest_release_url = "http://127.0.0.1:1/releases/latest"
 `), 0o600); err != nil {
 		t.Fatalf("WriteFile manifest returned error: %v", err)
 	}
diff --git a/mcp.toml b/mcp.toml
index 54f7c7d..3f24c8c 100644
--- a/mcp.toml
+++ b/mcp.toml
@@ -3,8 +3,13 @@ docs_url = "https://gitea.lclr.dev/AI/email-mcp"
 
 [update]
 source_name = "email-mcp releases"
+driver = "gitea"
+repository = "AI/email-mcp"
 base_url = "https://gitea.lclr.dev"
-latest_release_url = "https://gitea.lclr.dev/api/v1/repos/AI/email-mcp/releases/latest"
+asset_name_template = "{binary}-{os}-{arch}{ext}"
+checksum_asset_name = "{asset}.sha256"
+checksum_required = true
+token_env_names = ["GITEA_TOKEN"]
 
 [environment]
 known = ["EMAIL_MCP_PROFILE", "EMAIL_MCP_HOST", "EMAIL_MCP_USERNAME", "EMAIL_MCP_PASSWORD"]