diff --git a/isolated/profiles/emp-shunfeng/README.md b/isolated/profiles/emp-shunfeng/README.md
index 3061afc..2e3512f 100644
--- a/isolated/profiles/emp-shunfeng/README.md
+++ b/isolated/profiles/emp-shunfeng/README.md
@@ -32,11 +32,14 @@ pm2 list
 在我方受控构建机生成引导包：
 
 ```bash
-cd /home/git/deploy/isolated/profiles/emp-shunfeng
-EMP_ROOT=/home/git bash ./build-runtime-package.sh
+cd /home/git/deploy/isolated
+DEPLOY_ENV=emp-shunfeng COS_UPLOAD=1 EMP_ROOT=/home/git \
+  bash ./profiles/emp-shunfeng/build-runtime-package.sh
 ```
 
-把生成的 `dist/emp-shunfeng-runtime-bootstrap-*.tar.gz` 传到主、从服务器。两台服务器分别执行：
+脚本会把引导包上传到 COS，并输出 `Target bootstrap command`。将这段命令分别复制到主、从服务器执行一次即可；构建机不需要直通顺丰服务器，服务器上也不需要预先存在 `deploy-from-url.sh`。
+
+如果选择线下传包，也可以把生成的 `dist/emp-shunfeng-runtime-bootstrap-*.tar.gz` 放到主、从服务器，再分别执行：
 
 ```bash
 mkdir -p /tmp/emp-shunfeng-bootstrap
diff --git a/isolated/profiles/emp-shunfeng/build-runtime-package.sh b/isolated/profiles/emp-shunfeng/build-runtime-package.sh
index 69ec789..1baa6a8 100644
--- a/isolated/profiles/emp-shunfeng/build-runtime-package.sh
+++ b/isolated/profiles/emp-shunfeng/build-runtime-package.sh
@@ -7,6 +7,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ISOLATED_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
 EMP_ROOT="${EMP_ROOT:-}"
 DIST_DIR="${DIST_DIR:-$ISOLATED_DIR/dist}"
+COS_UPLOAD="${COS_UPLOAD:-0}"
 BUILD_TIME="${BUILD_TIME:-$(date '+%Y%m%d%H%M%S')}"
 PACKAGE_NAME="${PACKAGE_NAME:-emp-shunfeng-runtime-bootstrap-$BUILD_TIME}"
 PACKAGE_DIR="$DIST_DIR/$PACKAGE_NAME"
@@ -37,3 +38,10 @@ echo "Runtime bootstrap package: $PACKAGE_ARCHIVE"
 if command -v sha256sum >/dev/null 2>&1; then
   sha256sum "$PACKAGE_ARCHIVE"
 fi
+
+if [[ "$COS_UPLOAD" == "1" ]]; then
+  DEPLOY_ENV=emp-shunfeng \
+    PACKAGE_KIND=bootstrap \
+    TARGET_DEPLOY_HOME=/home/emp-shunfeng \
+    bash "$ISOLATED_DIR/publish-cos.sh" "$PACKAGE_ARCHIVE"
+fi
diff --git a/isolated/publish-cos.sh b/isolated/publish-cos.sh
index 2a311e7..16b98db 100644
--- a/isolated/publish-cos.sh
+++ b/isolated/publish-cos.sh
@@ -7,7 +7,7 @@ set -Eeuo pipefail
 #
 # Optional:
 #   DEPLOY_ENV=emp-uat
-#   PACKAGE_KIND=runtime|update
+#   PACKAGE_KIND=runtime|update|bootstrap
 #   COS_PREFIX=deploy/emp-uat/update/20260611120000
 #   COS_KEY=deploy/emp-uat/update/package.tar.gz
 #   COS_SIGN_EXPIRE=604800
@@ -79,6 +79,49 @@ print_target_deploy_command() {
     target_deploy_home="${TARGET_DEPLOY_HOME:-$TARGET_BASE_DIR/$DEPLOY_ENV}"
   fi
 
+  if [[ "$PACKAGE_KIND" == "bootstrap" ]]; then
+    cat <<EOF
+
+Target bootstrap command (run once on both shunfeng servers):
+set -Eeuo pipefail
+BOOTSTRAP_URL='$SIGNED_URL'
+BOOTSTRAP_SHA256='$SHA256'
+BOOTSTRAP_DIR="\$(mktemp -d /tmp/emp-shunfeng-bootstrap.XXXXXX)"
+BOOTSTRAP_FILE="\$BOOTSTRAP_DIR/package.tar.gz"
+
+if command -v curl >/dev/null 2>&1; then
+  curl -fL --retry 3 --connect-timeout 20 -o "\$BOOTSTRAP_FILE" "\$BOOTSTRAP_URL"
+elif command -v wget >/dev/null 2>&1; then
+  wget -O "\$BOOTSTRAP_FILE" "\$BOOTSTRAP_URL"
+else
+  echo "ERROR: missing curl or wget" >&2
+  exit 1
+fi
+
+if command -v sha256sum >/dev/null 2>&1; then
+  echo "\$BOOTSTRAP_SHA256  \$BOOTSTRAP_FILE" | sha256sum -c -
+elif command -v shasum >/dev/null 2>&1; then
+  test "\$(shasum -a 256 "\$BOOTSTRAP_FILE" | awk '{print \$1}')" = "\$BOOTSTRAP_SHA256"
+else
+  echo "ERROR: missing sha256sum or shasum" >&2
+  exit 1
+fi
+tar -xzf "\$BOOTSTRAP_FILE" -C "\$BOOTSTRAP_DIR" --strip-components=1
+
+OLD_EMP_DIR="\$(docker inspect emp-gateway --format '{{ index .Config.Labels "com.docker.compose.project.working_dir" }}')"
+test -n "\$OLD_EMP_DIR" && test -f "\$OLD_EMP_DIR/.env" || {
+  echo "ERROR: existing emp_server/.env not found" >&2
+  exit 1
+}
+
+DEPLOY_HOME=$target_deploy_home \\
+EXISTING_ENV_FILE="\$OLD_EMP_DIR/.env" \\
+bash "\$BOOTSTRAP_DIR/install-runtime.sh"
+
+EOF
+    return
+  fi
+
   if [[ "$PACKAGE_KIND" == "update" ]]; then
     target_script_dir="${TARGET_SCRIPT_DIR:-$target_deploy_home/runtime}"
   else