diff --git a/electron/main.js b/electron/main.js
index 25f7f04..5d2942c 100644
--- a/electron/main.js
+++ b/electron/main.js
@@ -12,6 +12,8 @@ try {
 }
 
 const HUB_URL = process.env.GAMING_HUB_URL || 'https://hub.daddelolymp.de';
+// Separate URL for auto-updates (no Pangolin auth, publicly accessible)
+const UPDATE_URL = process.env.GAMING_HUB_UPDATE_URL || 'https://updates.daddelolymp.de';
 const APP_VERSION = app.getVersion();
 
 // Sync IPC: preload reads app version from package.json
@@ -22,9 +24,9 @@ ipcMain.on('get-app-version', (event) => {
 function setupAutoUpdater() {
   if (process.platform !== 'win32') return;
 
-  // Squirrel.Windows appends /RELEASES to the feed URL,
-  // so point to /downloads where RELEASES + nupkg files live
-  const updateURL = `${HUB_URL}/downloads`;
+  // Squirrel.Windows appends /RELEASES to the feed URL.
+  // Uses separate subdomain without Pangolin auth (Squirrel has no browser session).
+  const updateURL = `${UPDATE_URL}/downloads`;
   try {
     autoUpdater.setFeedURL({ url: updateURL });
   } catch (e) {
@@ -235,21 +237,24 @@ document.getElementById('cancelBtn').addEventListener('click', () => {
           const state = parsed.searchParams.get('state') || '';
 
           if (code) {
-            // Exchange the code via our server
-            const resp = await fetch(`${HUB_URL}/api/game-library/gog/exchange`, {
-              method: 'POST',
-              headers: { 'Content-Type': 'application/json' },
-              body: JSON.stringify({ code, linkTo: state }),
-            });
-            const result = await resp.json();
+            // Exchange code via renderer fetch (has Pangolin session cookie)
+            const jsCode = `
+              fetch('/api/game-library/gog/exchange', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ code: ${JSON.stringify(code)}, linkTo: ${JSON.stringify(state)} }),
+              }).then(r => r.json()).then(result => {
+                window.dispatchEvent(new Event('gog-connected'));
+                return result;
+              })
+            `;
+            const result = await mainWindow.webContents.executeJavaScript(jsCode);
 
-            if (resp.ok && result.ok) {
+            if (result && result.ok) {
               childWindow.loadURL(`data:text/html,${encodeURIComponent(`<!DOCTYPE html><html><head><style>body{background:#1a1a2e;color:#fff;font-family:sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0}div{text-align:center}h2{color:#a855f7}</style></head><body><div><h2>GOG verbunden!</h2><p>${result.profileName}: ${result.gameCount} Spiele geladen.</p></div></body></html>`)}`);
-              // Notify renderer to refresh profiles
-              mainWindow.webContents.executeJavaScript('window.dispatchEvent(new Event("gog-connected"))');
               setTimeout(() => { try { childWindow.close(); } catch {} }, 2500);
             } else {
-              childWindow.loadURL(`data:text/html,${encodeURIComponent(`<!DOCTYPE html><html><head><style>body{background:#1a1a2e;color:#fff;font-family:sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0}div{text-align:center}h2{color:#e74c3c}</style></head><body><div><h2>Fehler</h2><p>${result.error || 'Unbekannter Fehler'}</p></div></body></html>`)}`);
+              childWindow.loadURL(`data:text/html,${encodeURIComponent(`<!DOCTYPE html><html><head><style>body{background:#1a1a2e;color:#fff;font-family:sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0}div{text-align:center}h2{color:#e74c3c}</style></head><body><div><h2>Fehler</h2><p>${(result && result.error) || 'Unbekannter Fehler'}</p></div></body></html>`)}`);
             }
           }
         } catch (err) {
