diff --git a/.env b/.env
index cbed358..8bbb58c 100644
--- a/.env
+++ b/.env
@@ -26,3 +26,6 @@ export SUBCONVERTER_VERSION="v0.9.9"
 
 # 内置运行依赖（resources/bin），设为 false 可强制跳过内置文件并联网下载
 export CLASH_BUNDLED_ASSET_ENABLED="true"
+
+# GitHub 资源下载镜像；设为 false 时仅访问 GitHub 原站
+export CLASH_GH_PROXY_ENABLED="true"
diff --git a/README.md b/README.md
index 82987d8..b21946b 100644
--- a/README.md
+++ b/README.md
@@ -346,6 +346,7 @@ SUBCONVERTER_VERSION=v0.9.9
 MIHOMO_DOWNLOAD_BASE=https://github.com/MetaCubeX/mihomo/releases/download
 CLASH_DOWNLOAD_BASE=https://github.com/WindSpiritSR/clash/releases/download
 CLASH_BUNDLED_ASSET_ENABLED=true
+CLASH_GH_PROXY_ENABLED=true
 CLASH_OFFLINE=false
 CLASH_SHELL_AUTO_RESTORE_PROXY=true
 CLASH_PREDOWNLOAD_GEO=true
@@ -363,6 +364,12 @@ CLASH_IPV6=auto
 
 所有来自 GitHub 的资源（内核、按需 GEO 数据、yq、subconverter、Dashboard）在下载时会自动尝试内置镜像池（`gh-proxy.org`、`ghfast.top`、`ghproxy.net`、`kkgithub.com`），无需额外配置即可加速。
 
+如果当前网络可以稳定直连 GitHub，可在 `.env` 中关闭镜像，只使用 GitHub 原站：
+
+```bash
+CLASH_GH_PROXY_ENABLED=false
+```
+
 如果默认镜像不满足需求，可在 `.env` 中指定自定义加速前缀：
 
 ```bash
@@ -376,6 +383,12 @@ CLASH_GH_PROXY=https://ghfast.top
 可用镜像列表参考：<https://ghproxy.link/>  
 当前镜像使用状态可通过 `clash doctor` 查看。
 
+该开关只控制 `bash install.sh`、`clash update`、`clash upgrade` 等脚本下载的 GitHub 资源，不会改变此前用于获取项目代码的 `git clone` 地址。如需从原站克隆，请使用：
+
+```bash
+git clone --branch master --depth 1 https://github.com/wnlen/clash-for-linux.git
+```
+
 ### 内置运行依赖
 
 当前正式支持的架构为 `amd64`、`arm64`、`armv7`。超出这三种架构时会明确失败，不会伪装成已支持。
diff --git a/scripts/core/clashctl.sh b/scripts/core/clashctl.sh
index 6391897..2daa7b3 100644
--- a/scripts/core/clashctl.sh
+++ b/scripts/core/clashctl.sh
@@ -3657,18 +3657,17 @@ doctor_dependencies() {
 doctor_download_mirrors() {
   doctor_print_title "下载加速配置"
 
-  local custom_prefix pool_source
+  local custom_prefix
   custom_prefix="$(github_proxy_prefix 2>/dev/null || true)"
 
-  if [ -n "${custom_prefix:-}" ]; then
+  if ! github_mirror_enabled; then
+    doctor_ok "GitHub 镜像已禁用，直接访问 GitHub 原站"
+  elif [ -n "${custom_prefix:-}" ]; then
     doctor_ok "自定义镜像（CLASH_GH_PROXY）：${custom_prefix}"
-    pool_source="custom"
   elif [ -n "${CLASH_GH_PROXY_POOL:-}" ]; then
     doctor_ok "自定义镜像池（CLASH_GH_PROXY_POOL）已配置"
-    pool_source="custom-pool"
   else
     doctor_ok "使用内置默认镜像池（gh-proxy.org / ghfast.top / ghproxy.net / kkgithub.com）"
-    pool_source="default"
   fi
 
   # Show mirror history from state file
@@ -3681,8 +3680,13 @@ doctor_download_mirrors() {
     [ -n "${last_fail:-}" ] && doctor_warn "上次失败镜像：${last_fail}"
   fi
 
-  doctor_ok "配置提示：在 .env 中设置 CLASH_GH_PROXY=https://your-mirror.com 可指定自定义加速前缀"
-  doctor_ok "可用镜像列表参考：https://ghproxy.link/"
+  if github_mirror_enabled; then
+    doctor_ok "配置提示：设置 CLASH_GH_PROXY_ENABLED=false 可关闭镜像并直连 GitHub 原站"
+    doctor_ok "配置提示：设置 CLASH_GH_PROXY=https://your-mirror.com 可指定自定义加速前缀"
+    doctor_ok "可用镜像列表参考：https://ghproxy.link/"
+  else
+    doctor_ok "配置提示：设置 CLASH_GH_PROXY_ENABLED=true 可重新启用 GitHub 镜像"
+  fi
 }
 
 doctor_config() {
diff --git a/scripts/core/common.sh b/scripts/core/common.sh
index de0bd08..0693e1a 100644
--- a/scripts/core/common.sh
+++ b/scripts/core/common.sh
@@ -410,6 +410,13 @@ github_proxy_prefix() {
   echo "$prefix"
 }
 
+github_mirror_enabled() {
+  case "${CLASH_GH_PROXY_ENABLED:-true}" in
+    false|0|no|off) return 1 ;;
+    *) return 0 ;;
+  esac
+}
+
 bundled_asset_enabled() {
   case "${CLASH_BUNDLED_ASSET_ENABLED:-true}" in
     true|1|yes|on) return 0 ;;
@@ -760,6 +767,11 @@ github_mirror_candidate_entries() {
     return 0
   }
 
+  if ! github_mirror_enabled; then
+    echo "origin||origin"
+    return 0
+  fi
+
   if [ -n "$(github_proxy_prefix)" ]; then
     entry="custom|$(github_proxy_prefix)|full"
     normalized="$(normalize_github_mirror_entry "$entry" 2>/dev/null || true)"
diff --git a/scripts/dev/check-download-mirror-priority.sh b/scripts/dev/check-download-mirror-priority.sh
index 8267e1b..10246d1 100644
--- a/scripts/dev/check-download-mirror-priority.sh
+++ b/scripts/dev/check-download-mirror-priority.sh
@@ -16,6 +16,7 @@ mkdir -p "$RUNTIME_DIR"
 unset CLASH_GH_PROXY
 unset URL_GH_PROXY
 unset CLASH_GH_PROXY_POOL
+unset CLASH_GH_PROXY_ENABLED
 
 url="https://github.com/MetaCubeX/meta-rules-dat/releases/download/latest/country.mmdb"
 ordered_entries="$(
@@ -40,3 +41,43 @@ if [ "$last_label" != "origin" ]; then
 fi
 
 echo "ok - default GitHub downloads prefer mirrors before origin"
+
+CLASH_GH_PROXY="https://mirror.example.com"
+CLASH_GH_PROXY_POOL="custom|https://pool.example.com|full"
+CLASH_GH_PROXY_ENABLED="false"
+ordered_entries="$(
+  github_mirror_candidate_entries_ordered "$url" \
+    | sort -t'|' -k1,1nr \
+    | cut -d'|' -f2-
+)"
+
+if [ "$ordered_entries" != "origin||origin" ]; then
+  echo "not ok - disabled GitHub mirrors: expected only origin" >&2
+  printf '%s\n' "$ordered_entries" >&2
+  exit 1
+fi
+
+origin_url="$(build_github_mirror_url "$ordered_entries" "$url")"
+if [ "$origin_url" != "$url" ]; then
+  echo "not ok - disabled GitHub mirrors: origin URL changed to $origin_url" >&2
+  exit 1
+fi
+
+echo "ok - disabled GitHub mirrors use only origin"
+
+CLASH_GH_PROXY_ENABLED="true"
+unset CLASH_GH_PROXY_POOL
+ordered_entries="$(
+  github_mirror_candidate_entries_ordered "$url" \
+    | sort -t'|' -k1,1nr \
+    | cut -d'|' -f2-
+)"
+first_entry="$(printf '%s\n' "$ordered_entries" | head -n 1)"
+
+if [ "$first_entry" != "custom|https://mirror.example.com|full" ]; then
+  echo "not ok - enabled custom GitHub mirror was not preferred" >&2
+  printf '%s\n' "$ordered_entries" >&2
+  exit 1
+fi
+
+echo "ok - enabled custom GitHub mirror remains preferred"