diff --git a/13.txt b/13.txt
new file mode 100644
index 00000000..ff9d0824
--- /dev/null
+++ b/13.txt
@@ -0,0 +1,237 @@
+name: sing-box sdk 24.10.6
+
+on:
+  workflow_dispatch:
+    inputs:
+      rr_wrt_branch:
+        description: rr-wrt branch for SDK artifact lookup
+        required: false
+        default: rr-wrt-v24.10.6
+      rr_wrt_artifact_name:
+        description: rr-wrt SDK artifact name
+        required: false
+        default: openwrt-filogic-sdk-ci
+
+jobs:
+  build:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 240
+    env:
+      DEBIAN_FRONTEND: noninteractive
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+
+      - name: install deps
+        run: |
+          set -euxo pipefail
+          sudo apt-get update
+          sudo apt-get install -y \
+            bash build-essential ca-certificates curl file findutils gawk git grep \
+            gzip jq rsync sed tar unzip wget xz-utils zstd
+
+      - name: setup external go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: sing-box-rr/go.mod
+          cache: false
+
+      - name: download sdk from rr-wrt artifact
+        shell: bash
+        env:
+          SAM_GAD: ${{ secrets.SAM_GAD }}
+        run: |
+          set -euxo pipefail
+          if [ -z "${SAM_GAD:-}" ]; then
+            echo "SAM_GAD secret is required for Gitea API artifact download"
+            exit 1
+          fi
+
+          RR_OWNER="routerich"
+          RR_REPO="rr-wrt"
+          RR_BRANCH='${{ inputs.rr_wrt_branch }}'
+          RR_ARTIFACT_NAME='${{ inputs.rr_wrt_artifact_name }}'
+          API_BASE="https://git.routerich.ru/api/v1/repos/${RR_OWNER}/${RR_REPO}/actions"
+
+          if [[ "$SAM_GAD" == *:* ]]; then
+            AUTH_ARGS=(-u "$SAM_GAD")
+          else
+            AUTH_ARGS=(-H "Authorization: token $SAM_GAD")
+          fi
+
+          artifacts_json="$RUNNER_TEMP/rr-wrt-artifacts.json"
+          curl -fsSL "${AUTH_ARGS[@]}" \
+            "${API_BASE}/artifacts?name=${RR_ARTIFACT_NAME}&per_page=100&page=1" \
+            -o "$artifacts_json"
+
+          jq -r '
+            def arr:
+              if type == "array" then .
+              elif has("artifacts") then .artifacts
+              elif has("data") then .data
+              else [] end;
+            arr[]? | "\(.id // "na")\t\(.name // "na")\t\(.workflow_run.head_branch? // .workflow_run.branch? // .workflow_run.ref? // .ref? // "na")\t\(.expired? // false)"
+          ' "$artifacts_json" > "$RUNNER_TEMP/rr-wrt-artifacts-list.txt" || true
+          head -n 20 "$RUNNER_TEMP/rr-wrt-artifacts-list.txt" || true
+
+          artifact_id="$(jq -r --arg n "$RR_ARTIFACT_NAME" --arg b "$RR_BRANCH" '
+            def arr:
+              if type == "array" then .
+              elif has("artifacts") then .artifacts
+              elif has("data") then .data
+              else [] end;
+            [
+              arr[]?
+              | select((.name // "") == $n)
+              | select(
+                  (
+                    .workflow_run.head_branch?
+                    // .workflow_run.branch?
+                    // .workflow_run.ref?
+                    // .ref?
+                    // .source_branch?
+                    // ""
+                  ) == $b
+                )
+              | select((.expired? // false) == false)
+            ]
+            | sort_by(.id // 0)
+            | reverse
+            | .[0].id // empty
+          ' "$artifacts_json")"
+
+          if [ -z "$artifact_id" ]; then
+            artifact_id="$(jq -r --arg n "$RR_ARTIFACT_NAME" '
+              def arr:
+                if type == "array" then .
+                elif has("artifacts") then .artifacts
+                elif has("data") then .data
+                else [] end;
+              [
+                arr[]?
+                | select((.name // "") == $n)
+                | select((.expired? // false) == false)
+              ]
+              | sort_by(.id // 0)
+              | reverse
+              | .[0].id // empty
+            ' "$artifacts_json")"
+          fi
+
+          if [ -z "$artifact_id" ]; then
+            echo "No artifact found: name=${RR_ARTIFACT_NAME}, branch=${RR_BRANCH}"
+            exit 1
+          fi
+
+          mkdir -p "$RUNNER_TEMP/sdk" "$RUNNER_TEMP/sdk-artifact"
+          SDK_ARTIFACT_ZIP="$RUNNER_TEMP/sdk-artifact.zip"
+          curl -fL "${AUTH_ARGS[@]}" \
+            "${API_BASE}/artifacts/${artifact_id}/zip" \
+            -o "$SDK_ARTIFACT_ZIP"
+
+          unzip -q "$SDK_ARTIFACT_ZIP" -d "$RUNNER_TEMP/sdk-artifact"
+
+          SDK_ARCHIVE="$(find "$RUNNER_TEMP/sdk-artifact" -type f -name '*.tar.zst' | head -n1)"
+          test -n "$SDK_ARCHIVE"
+
+          tar --zstd -xf "$SDK_ARCHIVE" -C "$RUNNER_TEMP/sdk"
+
+          SDK_DIR="$(find "$RUNNER_TEMP/sdk" -mindepth 1 -maxdepth 1 -type d | head -n1)"
+          test -n "$SDK_DIR"
+
+          echo "SDK_SOURCE_ARTIFACT_ID=$artifact_id" >> "$GITHUB_ENV"
+          echo "SDK_ARCHIVE=$SDK_ARCHIVE" >> "$GITHUB_ENV"
+          echo "SDK_DIR=$SDK_DIR" >> "$GITHUB_ENV"
+
+      - name: stage sing-box-rr package into sdk
+        shell: bash
+        run: |
+          set -euxo pipefail
+          test -d "$SDK_DIR"
+
+          rm -rf "$SDK_DIR/package/sing-box-rr"
+          mkdir -p "$SDK_DIR/package/sing-box-rr"
+
+          rsync -a --delete ./sing-box-rr/ "$SDK_DIR/package/sing-box-rr/"
+          cp -f ./VERSION "$SDK_DIR/package/VERSION"
+          cp -f ./SOURCE_DATE_EPOCH "$SDK_DIR/package/SOURCE_DATE_EPOCH"
+
+      - name: build package in sdk
+        id: build
+        continue-on-error: true
+        shell: bash
+        run: |
+          set -euxo pipefail
+          mkdir -p logs
+          cd "$SDK_DIR"
+
+          go version > "$GITHUB_WORKSPACE/logs/go-version.log" 2>&1
+          command -v go > "$GITHUB_WORKSPACE/logs/go-bin.log" 2>&1
+          make defconfig > "$GITHUB_WORKSPACE/logs/sdk-defconfig.log" 2>&1
+
+          set +e
+          # Clean first so the package rebuilds even when VERSION stays unchanged.
+          make -j"$(nproc)" package/sing-box-rr/clean > "$GITHUB_WORKSPACE/logs/pkg-clean.log" 2>&1
+          make -j"$(nproc)" package/sing-box-rr/compile V=s GO_BIN="$(command -v go)" > "$GITHUB_WORKSPACE/logs/pkg-build.log" 2>&1
+          rc=$?
+          if [ "$rc" -ne 0 ]; then
+            tail -n 400 "$GITHUB_WORKSPACE/logs/pkg-build.log" || true
+          fi
+          exit "$rc"
+
+      - name: collect packages artifact
+        if: always()
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p artifacts/packages logs
+
+          find "$SDK_DIR/bin/packages" -type f -name 'sing-box-rr_*.ipk' -print | sort > logs/packages-found.txt || true
+
+          pkg="$(tail -n1 logs/packages-found.txt || true)"
+          if [ -n "${pkg:-}" ]; then
+            cp -f "$pkg" artifacts/packages/
+          else
+            echo "err sing-box-rr package not found in sdk output" | tee -a logs/packages-filter.txt
+          fi
+
+          pkg_count=$(find artifacts/packages -maxdepth 1 -type f -name 'sing-box-rr_*.ipk' | wc -l | tr -d ' ')
+          if [ "$pkg_count" -ne 1 ]; then
+            echo "err expected exactly 1 sing-box-rr package in artifact, got $pkg_count" | tee -a logs/packages-filter.txt
+            exit 1
+          fi
+
+          ls -lah artifacts/packages > logs/packages-ls.txt 2>&1 || true
+
+      - name: upload logs
+        if: always()
+        uses: christopherhx/gitea-upload-artifact@v4
+        with:
+          name: sing-box-rr-build-logs
+          path: logs/
+          if-no-files-found: warn
+          compression-level: 0
+
+      - name: upload sdk archive
+        if: always()
+        uses: christopherhx/gitea-upload-artifact@v4
+        with:
+          name: openwrt-sdk-24.10.6
+          path: ${{ env.SDK_ARCHIVE }}
+          if-no-files-found: warn
+          compression-level: 0
+
+      - name: upload packages artifact
+        if: always()
+        uses: christopherhx/gitea-upload-artifact@v4
+        with:
+          name: sing-box-rr-packages-24.10.6
+          path: artifacts/packages/
+          if-no-files-found: warn
+          compression-level: 0
+
+      - name: fail workflow if build failed
+        if: steps.build.outcome == 'failure'
+        run: |
+          echo "package build failed"
+          exit 1
diff --git a/README.md b/README.md
index c1b0a9f5..cde3933e 100644
--- a/README.md
+++ b/README.md
@@ -28,8 +28,10 @@ make package/feeds/singboxrr/sing-box-rr/compile V=s GO_BIN=/usr/local/go/bin/go
 
 ### Где задаётся `r`-релиз пакета
 
-`PKG_RELEASE` задаётся только в [sing-box-rr/Makefile](./sing-box-rr/Makefile).
-Root-скрипты [build-ipk.sh](./build-ipk.sh) и [build-apk.sh](./build-apk.sh) не держат своё значение `r*`, а читают его оттуда.
+`r`-релиз теперь задаётся прямо в корневом [VERSION](./VERSION).
+Формат строки: `1.13.11-rr-edition-2.1.0-r6`.
+
+[sing-box-rr/Makefile](./sing-box-rr/Makefile), [build-ipk.sh](./build-ipk.sh) и [build-apk.sh](./build-apk.sh) не держат своё значение `r*`, а парсят его из этого файла.
 
 ## 1. Что уже отключено
 
@@ -332,8 +334,8 @@ Providers уже отключены в текущем форке. Ключевы
 
 Если меняешь package name или `Provides`, сначала проверь зависимости downstream-пакетов.
 
-`PKG_RELEASE` тоже нужно менять именно в [sing-box-rr/Makefile](./sing-box-rr/Makefile).
-Root-скрипты читают release оттуда, поэтому это единственный источник истины для `r1`, `r2` и дальше.
+`r`-релиз тоже нужно менять именно в корневом [VERSION](./VERSION).
+Это теперь единственный источник истины для `r1`, `r2` и дальше.
 
 ### OpenWrt feeds build
 
diff --git a/VERSION b/VERSION
index 6440ae41..35479845 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.13.11-rr-edition-2.1.0
+1.13.11-rr-edition-2.1.0-r6
diff --git a/build-apk.sh b/build-apk.sh
index 0c088aff..dc0815b8 100755
--- a/build-apk.sh
+++ b/build-apk.sh
@@ -3,7 +3,6 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PROJECT_DIR="$SCRIPT_DIR/sing-box-rr"
-PACKAGE_MAKEFILE="$PROJECT_DIR/Makefile"
 GO_BIN="${GO_BIN:-/usr/local/go/bin/go}"
 GO_CACHE_DIR="${GO_CACHE_DIR:-/tmp/sing-box-rr-go-build}"
 GO_MODCACHE_DIR="${GO_MODCACHE_DIR:-/tmp/sing-box-rr-go-mod}"
@@ -30,7 +29,7 @@ project_version() {
     if [ -f "$SCRIPT_DIR/VERSION" ]; then
         cat "$SCRIPT_DIR/VERSION"
     else
-        echo "0.0.0-unknown"
+        echo "0.0.0-unknown-r1"
     fi
 }
 
@@ -42,9 +41,13 @@ project_source_date_epoch() {
     fi
 }
 
+project_version_base() {
+    project_version | sed -E 's/-r[0-9]+$//'
+}
+
 package_release() {
     local release
-    release="$(sed -nE 's/^PKG_RELEASE[[:space:]]*:?=[[:space:]]*([0-9]+).*/\1/p' "$PACKAGE_MAKEFILE" | head -n1)"
+    release="$(project_version | sed -nE 's/^.*-r([0-9]+)$/\1/p' | head -n1)"
     if [ -n "$release" ]; then
         echo "$release"
     else
@@ -54,7 +57,7 @@ package_release() {
 
 apk_version() {
     local version
-    version="$(project_version | sed -nE 's/^([0-9]+\.[0-9]+\.[0-9]+).*/\1/p')"
+    version="$(project_version_base | sed -nE 's/^([0-9]+\.[0-9]+\.[0-9]+).*/\1/p')"
     [ -n "$version" ] || version="0.0.0"
     echo "${version}-r$(package_release)"
 }
diff --git a/build-ipk.sh b/build-ipk.sh
index 82460b72..65b4442c 100755
--- a/build-ipk.sh
+++ b/build-ipk.sh
@@ -3,7 +3,6 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PROJECT_DIR="$SCRIPT_DIR/sing-box-rr"
-PACKAGE_MAKEFILE="$PROJECT_DIR/Makefile"
 GO_BIN="${GO_BIN:-/usr/local/go/bin/go}"
 GO_CACHE_DIR="${GO_CACHE_DIR:-/tmp/sing-box-rr-go-build}"
 GO_MODCACHE_DIR="${GO_MODCACHE_DIR:-/tmp/sing-box-rr-go-mod}"
@@ -30,7 +29,7 @@ project_version() {
     if [ -f "$SCRIPT_DIR/VERSION" ]; then
         cat "$SCRIPT_DIR/VERSION"
     else
-        echo "0.0.0-unknown"
+        echo "0.0.0-unknown-r1"
     fi
 }
 
@@ -42,9 +41,13 @@ project_source_date_epoch() {
     fi
 }
 
+project_version_base() {
+    project_version | sed -E 's/-r[0-9]+$//'
+}
+
 package_release() {
     local release
-    release="$(sed -nE 's/^PKG_RELEASE[[:space:]]*:?=[[:space:]]*([0-9]+).*/\1/p' "$PACKAGE_MAKEFILE" | head -n1)"
+    release="$(project_version | sed -nE 's/^.*-r([0-9]+)$/\1/p' | head -n1)"
     if [ -n "$release" ]; then
         echo "$release"
     else
@@ -53,7 +56,7 @@ package_release() {
 }
 
 ipk_version() {
-    echo "$(project_version)-r$(package_release)"
+    echo "$(project_version_base)-r$(package_release)"
 }
 
 build_tags() {
diff --git a/sing-box-rr/Makefile b/sing-box-rr/Makefile
index 8a5c82a7..3d837762 100644
--- a/sing-box-rr/Makefile
+++ b/sing-box-rr/Makefile
@@ -2,8 +2,10 @@ include $(TOPDIR)/rules.mk
 
 PROJECT_DIR:=$(CURDIR)
 PKG_NAME:=sing-box-rr
-PKG_VERSION:=$(shell cat $(CURDIR)/../VERSION 2>/dev/null || echo 0.0.0-unknown)
-PKG_RELEASE:=6
+SINGBOX_RR_PROJECT_VERSION:=$(shell cat $(CURDIR)/../VERSION 2>/dev/null || echo 0.0.0-unknown-r1)
+PKG_VERSION:=$(shell printf '%s\n' '$(SINGBOX_RR_PROJECT_VERSION)' | sed -E 's/-r[0-9]+$$//')
+PKG_RELEASE:=$(shell printf '%s\n' '$(SINGBOX_RR_PROJECT_VERSION)' | sed -nE 's/^.*-r([0-9]+)$$/\1/p')
+PKG_RELEASE:=$(if $(PKG_RELEASE),$(PKG_RELEASE),1)
 PKG_SOURCE_DATE_EPOCH:=$(shell cat $(CURDIR)/../SOURCE_DATE_EPOCH 2>/dev/null || date +%s)
 
 PKG_LICENSE:=GPL-3.0-or-later
@@ -20,7 +22,7 @@ SINGBOX_RR_GOCACHE?=$(TMP_DIR)/sing-box-rr-go-build
 SINGBOX_RR_GOMODCACHE?=$(DL_DIR)/sing-box-rr-go-mod
 SINGBOX_RR_TAGS:=$(shell tr -d '\n' < $(PROJECT_DIR)/release/DEFAULT_BUILD_TAGS_OTHERS 2>/dev/null)
 SINGBOX_RR_BASE_LDFLAGS:=$(shell tr -d '\n' < $(PROJECT_DIR)/release/LDFLAGS 2>/dev/null)
-SINGBOX_RR_LDFLAGS:=$(strip $(SINGBOX_RR_BASE_LDFLAGS) -X github.com/sagernet/sing-box/constant.Version=$(PKG_VERSION) -s -w)
+SINGBOX_RR_LDFLAGS:=$(strip $(SINGBOX_RR_BASE_LDFLAGS) -X github.com/sagernet/sing-box/constant.Version=$(SINGBOX_RR_PROJECT_VERSION) -s -w)
 
 ifeq ($(ARCH),aarch64)
   SINGBOX_RR_GOARCH:=arm64