diff --git a/clashoo/Makefile b/clashoo/Makefile
index 35f33ac6..ddb5515f 100644
--- a/clashoo/Makefile
+++ b/clashoo/Makefile
@@ -1,8 +1,8 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=clashoo
-PKG_SHORT_SHA:=8f54283
-PKG_COMMIT_DATE:=2026.09.07
+PKG_SHORT_SHA:=a91201f
+PKG_COMMIT_DATE:=2026.09.08
 
 PKG_VERSION:=$(PKG_COMMIT_DATE)~$(PKG_SHORT_SHA)
 PKG_RELEASE:=1
@@ -11,8 +11,8 @@ PKG_SOURCE:=$(PKG_NAME)-alpha-$(PKG_SHORT_SHA).tar.gz
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-alpha-$(PKG_SHORT_SHA)
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-alpha-$(PKG_SHORT_SHA)
 PKG_SOURCE_URL:=https://github.com/kenzok8/openwrt-clashoo/releases/download/mihomo-src
-PKG_SOURCE_VERSION:=8f54283e97728859d88f45025bab250504337687
-PKG_HASH:=28db96ba63d8f4e79df122c1efe02fed485e1997cf1888e5d045c17908aa34a9
+PKG_SOURCE_VERSION:=a91201f1fc1eb9576f284a4655d819326662fb61
+PKG_HASH:=ca9c09031531332890ceadab7748ad33a24e391eac1b8a6de929c38151eeca7e
 PKG_BUILD_VERSION:=alpha-$(PKG_SHORT_SHA)
 
 PKG_LICENSE:=GPL3.0+
diff --git a/luci-app-passwall/Makefile b/luci-app-passwall/Makefile
index 28b8ac59..cb0f79f7 100644
--- a/luci-app-passwall/Makefile
+++ b/luci-app-passwall/Makefile
@@ -164,9 +164,17 @@ define Package/$(PKG_NAME)/conffiles
 /usr/share/passwall/rules/domains_excluded
 endef
 
+define Package/$(PKG_NAME)/postinst
+#!/bin/sh
+rm -f $${IPKG_INSTROOT}/usr/share/passwall/rules/*.nft
+rm -rf $${IPKG_INSTROOT}/tmp/etc/passwall_tmp
+exit 0
+endef
+
 define Package/$(PKG_NAME)/postrm
 #!/bin/sh
 rm -f $${IPKG_INSTROOT}/usr/share/passwall/rules/*.nft
+rm -rf $${IPKG_INSTROOT}/tmp/etc/passwall_tmp
 exit 0
 endef
 
diff --git a/luci-app-passwall/luasrc/passwall/api.lua b/luci-app-passwall/luasrc/passwall/api.lua
index 8a939d8d..d9d3cf8f 100644
--- a/luci-app-passwall/luasrc/passwall/api.lua
+++ b/luci-app-passwall/luasrc/passwall/api.lua
@@ -1378,11 +1378,22 @@ function to_move(app_name,file)
 end
 
 function get_version()
-	local version = sys.exec("opkg list-installed luci-app-passwall 2>/dev/null | awk '{print $3}'")
-	if not version or #version == 0 then
-		version = sys.exec("apk list luci-app-passwall 2>/dev/null | awk '/installed/ {print $1}' | cut -d'-' -f4-")
+	local version
+	local version_file = CACHE_PATH .. "/passwall_version"
+	sys.call("mkdir -p " .. CACHE_PATH)
+	if fs.access(version_file) then
+		version = fs.readfile(version_file)
+	else
+		version = sys.exec("opkg list-installed luci-app-passwall 2>/dev/null | awk '{print $3}'")
+		if not version or version == "" then
+			version = sys.exec("apk list luci-app-passwall 2>/dev/null | awk '/installed/ {print $1}' | cut -d'-' -f4-")
+		end
+		version = (version or ""):match("^%s*(.-)%s*$")
+		if version ~= "" then
+			fs.writefile(version_file, version)
+		end
 	end
-	return (version or ""):gsub("\n", ""):match("^([^-]+)")
+	return version:match("^([^-]+)") or ""
 end
 
 function to_check_self()
diff --git a/luci-app-passwall/luasrc/passwall/util_sing-box.lua b/luci-app-passwall/luasrc/passwall/util_sing-box.lua
index 32ed5428..6c0b8da4 100644
--- a/luci-app-passwall/luasrc/passwall/util_sing-box.lua
+++ b/luci-app-passwall/luasrc/passwall/util_sing-box.lua
@@ -2216,14 +2216,10 @@ function gen_config(var)
 		})
 	else
 		table.insert(dns.rules, 1, {
-			action = "evaluate",
+			preferred_by = "hosts",
+			action = "route",
 			server = "hosts"
 		})
-		table.insert(dns.rules, 2, {
-			match_response = true,
-			ip_accept_any = true,
-			action = "respond"
-		})
 	end
 
 	if COMMON.default_outbound_tag == "block" then
diff --git a/luci-app-passwall/luasrc/passwall/util_xray.lua b/luci-app-passwall/luasrc/passwall/util_xray.lua
index 0bc35e4f..8747a922 100644
--- a/luci-app-passwall/luasrc/passwall/util_xray.lua
+++ b/luci-app-passwall/luasrc/passwall/util_xray.lua
@@ -1800,8 +1800,8 @@ function gen_config(var)
 			remote_dns_outbound = {
 				tag = "dns-out",
 				protocol = "dns",
-				proxySettings = dns_outbound_tag and {
-					tag = (dns_outbound_tag ~= "blackhole") and dns_outbound_tag or "direct"
+				streamSettings = dns_outbound_tag and {
+					sockopt = { dialerProxy = (dns_outbound_tag ~= "blackhole") and dns_outbound_tag or "direct" }
 				} or nil,
 				settings = {
 					address = (chn_list ~= "proxy") and "8.8.8.8" or "223.5.5.5",