diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index c86a1fda135..d2c528e1720 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -117,6 +117,88 @@ jobs:
     outputs:
       version: ${{ needs.version.outputs.version }}
 
+  sign-cli-macos:
+    needs:
+      - build-cli
+      - version
+    runs-on: macos-26
+    if: github.repository == 'anomalyco/opencode'
+    steps:
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+
+      - uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
+        with:
+          keychain: build
+          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE }}
+          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: opencode-cli
+          path: packages/opencode/dist
+
+      - name: Setup git committer
+        id: committer
+        uses: ./.github/actions/setup-git-committer
+        with:
+          opencode-app-id: ${{ vars.OPENCODE_APP_ID }}
+          opencode-app-secret: ${{ secrets.OPENCODE_APP_SECRET }}
+
+      - name: Sign macOS CLI binaries
+        run: |
+          identity=$(security find-identity -v -p codesigning build.keychain | sed -n 's/.*"\(Developer ID Application:.*\)"/\1/p' | head -n 1)
+          if [ -z "$identity" ]; then
+            echo "Developer ID Application identity not found"
+            exit 1
+          fi
+
+          for name in opencode-darwin-arm64 opencode-darwin-x64 opencode-darwin-x64-baseline; do
+            file="packages/opencode/dist/$name/bin/opencode"
+            chmod +x "$file"
+            codesign \
+              --force \
+              --timestamp \
+              --options runtime \
+              --entitlements packages/opencode/script/entitlements.plist \
+              --sign "$identity" \
+              "$file"
+            codesign --verify --deep --strict --verbose=4 "$file"
+            codesign --display --requirements - "$file"
+          done
+
+      - name: Smoke test signed binary
+        run: ./packages/opencode/dist/opencode-darwin-arm64/bin/opencode --version
+
+      - name: Repack macOS CLI archives
+        working-directory: packages/opencode/dist
+        run: |
+          for name in opencode-darwin-arm64 opencode-darwin-x64 opencode-darwin-x64-baseline; do
+            rm -f "$name.zip"
+            (cd "$name/bin" && zip -r "../../$name.zip" *)
+          done
+
+      - name: Upload signed macOS CLI release assets
+        if: needs.version.outputs.release != ''
+        env:
+          GH_TOKEN: ${{ steps.committer.outputs.token }}
+        run: |
+          gh release upload "v${{ needs.version.outputs.version }}" \
+            packages/opencode/dist/opencode-darwin-arm64.zip \
+            packages/opencode/dist/opencode-darwin-x64.zip \
+            packages/opencode/dist/opencode-darwin-x64-baseline.zip \
+            --clobber \
+            --repo "${{ needs.version.outputs.repo }}"
+
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: opencode-cli-signed-macos
+          path: |
+            packages/opencode/dist/opencode-darwin-arm64
+            packages/opencode/dist/opencode-darwin-x64
+            packages/opencode/dist/opencode-darwin-x64-baseline
+            packages/opencode/dist/opencode-darwin-*.zip
+          if-no-files-found: error
+
   sign-cli-windows:
     needs:
       - build-cli
@@ -405,6 +487,7 @@ jobs:
     needs:
       - version
       - build-cli
+      - sign-cli-macos
       - sign-cli-windows
       - build-electron
     if: always() && !failure() && !cancelled()
@@ -437,6 +520,14 @@ jobs:
           name: opencode-cli
           path: packages/opencode/dist
 
+      - name: Remove unsigned macOS CLI binaries
+        run: rm -rf packages/opencode/dist/opencode-darwin*
+
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: opencode-cli-signed-macos
+          path: packages/opencode/dist
+
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: opencode-cli-windows
diff --git a/packages/opencode/script/entitlements.plist b/packages/opencode/script/entitlements.plist
new file mode 100644
index 00000000000..afa54db33b9
--- /dev/null
+++ b/packages/opencode/script/entitlements.plist
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-executable-page-protection</key>
+    <true/>
+    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+</dict>
+</plist>