diff --git a/.github/workflows/publish-platform.yml b/.github/workflows/publish-platform.yml
index 3b9d2d001..6fca187b0 100644
--- a/.github/workflows/publish-platform.yml
+++ b/.github/workflows/publish-platform.yml
@@ -35,7 +35,7 @@ jobs:
   # - Uploads compressed artifacts for the publish job
   # =============================================================================
   build:
-    runs-on: ${{ startsWith(matrix.platform, 'windows-') && 'windows-latest' || 'ubuntu-latest' }}
+    runs-on: ${{ startsWith(matrix.platform, 'windows-') && 'windows-latest' || startsWith(matrix.platform, 'darwin-') && 'macos-latest' || 'ubuntu-latest' }}
     defaults:
       run:
         shell: bash
@@ -213,6 +213,14 @@ jobs:
             echo "Built binary:"
             ls -lh "$OUTPUT"
 
+      - name: Ad-hoc codesign darwin binary
+        if: steps.check.outputs.skip != 'true' && startsWith(matrix.platform, 'darwin-')
+        run: |
+          BINARY="packages/${{ matrix.platform }}/bin/oh-my-opencode"
+          codesign --force --sign - --preserve-metadata=entitlements,requirements,flags,runtime "$BINARY"
+          echo "Verifying signature:"
+          codesign -dvvv "$BINARY" 2>&1
+
       - name: Compress binary
         if: steps.check.outputs.skip != 'true'
         run: |