diff --git a/scripts/update-json.sh b/scripts/update-json.sh
new file mode 100755
index 0000000..a655db3
--- /dev/null
+++ b/scripts/update-json.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# Generates Magisk/KSU updateJson files pointing to the current VERSION.
+# Run AFTER the GitHub release is published so zipUrl is already valid.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+VERSION="$(tr -d '[:space:]' < VERSION)"
+
+if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+    echo "error: VERSION must be MAJOR.MINOR.PATCH, got '$VERSION'" >&2
+    exit 1
+fi
+
+IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"
+VERSION_CODE=$(( MAJOR * 10000 + MINOR * 100 + PATCH ))
+
+REPO="https://github.com/okhsunrog/vpnhide"
+RAW="https://raw.githubusercontent.com/okhsunrog/vpnhide/main"
+
+echo "Generating update-json for v${VERSION} (versionCode: $VERSION_CODE)"
+
+mkdir -p update-json
+KMOD_KMIS=("android12-5.10" "android13-5.10" "android13-5.15" "android14-5.15" "android14-6.1" "android15-6.6" "android16-6.12")
+for kmi in "${KMOD_KMIS[@]}"; do
+    cat > "update-json/update-kmod-${kmi}.json" <<EOJSON
+{
+  "version": "v${VERSION}",
+  "versionCode": ${VERSION_CODE},
+  "zipUrl": "${REPO}/releases/download/v${VERSION}/vpnhide-kmod-${kmi}.zip",
+  "changelog": "${RAW}/update-json/changelog.md"
+}
+EOJSON
+    echo "  update-json/update-kmod-${kmi}.json"
+done
+
+cat > "update-json/update-zygisk.json" <<EOJSON
+{
+  "version": "v${VERSION}",
+  "versionCode": ${VERSION_CODE},
+  "zipUrl": "${REPO}/releases/download/v${VERSION}/vpnhide-zygisk.zip",
+  "changelog": "${RAW}/update-json/changelog.md"
+}
+EOJSON
+echo "  update-json/update-zygisk.json"
diff --git a/update-version.sh b/scripts/update-version.sh
similarity index 57%
rename from update-version.sh
rename to scripts/update-version.sh
index 427f94d..bf88fc9 100755
--- a/update-version.sh
+++ b/scripts/update-version.sh
@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
-# Reads VERSION file and updates all version references in the monorepo.
+# Reads VERSION file and updates all version references in source files.
+# Does NOT touch update-json — run update-json.sh after the release is published.
 set -euo pipefail
-cd "$(dirname "$0")"
+cd "$(dirname "$0")/.."
 
 VERSION="$(tr -d '[:space:]' < VERSION)"
 
@@ -39,31 +40,3 @@ echo "  zygisk/module/module.prop"
 echo "  zygisk/Cargo.toml"
 echo "  lsposed/app/build.gradle.kts"
 echo "  lsposed/native/Cargo.toml"
-
-# Generate Magisk/KSU updateJson files
-REPO="https://github.com/okhsunrog/vpnhide"
-RAW="https://raw.githubusercontent.com/okhsunrog/vpnhide/main"
-
-mkdir -p update-json
-KMOD_KMIS=("android12-5.10" "android13-5.10" "android13-5.15" "android14-5.15" "android14-6.1" "android15-6.6" "android16-6.12")
-for kmi in "${KMOD_KMIS[@]}"; do
-    cat > "update-json/update-kmod-${kmi}.json" <<EOJSON
-{
-  "version": "v${VERSION}",
-  "versionCode": ${VERSION_CODE},
-  "zipUrl": "${REPO}/releases/download/v${VERSION}/vpnhide-kmod-${kmi}.zip",
-  "changelog": "${RAW}/update-json/changelog.md"
-}
-EOJSON
-    echo "  update-json/update-kmod-${kmi}.json"
-done
-
-cat > "update-json/update-zygisk.json" <<EOJSON
-{
-  "version": "v${VERSION}",
-  "versionCode": ${VERSION_CODE},
-  "zipUrl": "${REPO}/releases/download/v${VERSION}/vpnhide-zygisk.zip",
-  "changelog": "${RAW}/update-json/changelog.md"
-}
-EOJSON
-echo "  update-json/update-zygisk.json"