diff --git a/.github/workflows/release-probo-agent.yaml b/.github/workflows/release-probo-agent.yaml
index e2be0c427..6bb82715c 100644
--- a/.github/workflows/release-probo-agent.yaml
+++ b/.github/workflows/release-probo-agent.yaml
@@ -80,7 +80,7 @@ jobs:
           retention-days: 1
 
   build-macos:
-    name: "macos (universal pkg + darwin archives)"
+    name: "macos (darwin pkg + darwin archives)"
     runs-on: "macos-26"
     permissions:
       contents: "read"
@@ -112,7 +112,7 @@ jobs:
           security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
           security list-keychain -d user -s "$KEYCHAIN_PATH"
           rm certificate.p12
-      - name: "Build CGO darwin binaries and universal pkg"
+      - name: "Build CGO darwin binaries and darwin pkg"
         env:
           CGO_ENABLED: "1"
           CODESIGN_IDENTITY: "${{ secrets.CODESIGN_IDENTITY }}"
@@ -151,18 +151,16 @@ jobs:
           done
 
           chmod +x cmd/probo-agent/installer/macos/build.sh \
-            cmd/probo-agent/installer/macos/enroll-ui/build-app.sh \
             cmd/probo-agent/installer/macos/scripts/preinstall \
             cmd/probo-agent/installer/macos/scripts/postinstall
 
           cmd/probo-agent/installer/macos/build.sh \
             --binary dist/probo-agent_universal \
-            --arch universal \
             --version "${VERSION}" \
-            --output "archives/probo-agent_${VERSION}_darwin_universal.pkg"
+            --output "archives/probo-agent_${VERSION}_darwin.pkg"
       - uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7
         with:
-          name: "archive-darwin-universal"
+          name: "archive-darwin"
           path: "archives/"
           retention-days: 1
 
diff --git a/cmd/probo-agent/GNUmakefile b/cmd/probo-agent/GNUmakefile
index cc6b329d3..40967fb47 100644
--- a/cmd/probo-agent/GNUmakefile
+++ b/cmd/probo-agent/GNUmakefile
@@ -69,7 +69,12 @@ ARCHIVE_PATH=		$(RELEASE_DIR)/$(ARCHIVE_NAME)
 STAGING_DIR=		$(CACHE_ROOT)/staging/$(AGENT_DIR)
 BUILD_BINARY=		$(STAGING_DIR)/probo-agent
 
-PKG=			$(REPO_ROOT)/dist/probo-agent_$(VERSION)_darwin_$(ARCH_LABEL).pkg
+# Fat binary required by installer/macos/build.sh (arm64 + x86_64).
+FAT_BINARY=		$(REPO_ROOT)/dist/probo-agent_fat
+THIN_ARM64=		$(REPO_ROOT)/dist/probo-agent_arm64
+THIN_AMD64=		$(REPO_ROOT)/dist/probo-agent_amd64
+PKG=			$(REPO_ROOT)/dist/probo-agent_$(VERSION)_darwin.pkg
+AGENT_LDFLAGS=		-ldflags "-X 'main.version=$(VERSION)'"
 
 INSTALL_ARGS?=		--skip-service --dir "$(STATE_DIR)"
 INSTALL_ENV=		PROBO_AGENT_RELEASE_TAG="$(DEV_TAG)" \
@@ -80,7 +85,7 @@ INSTALL_ENV=		PROBO_AGENT_RELEASE_TAG="$(DEV_TAG)" \
 			PROBO_ENROLLMENT_TOKEN="$(PROBO_ENROLLMENT_TOKEN)"
 
 .PHONY: help all pkg install uninstall clean clean-build install-cli run
-.PHONY: $(PROBO_AGENT_BIN)
+.PHONY: $(PROBO_AGENT_BIN) $(FAT_BINARY)
 
 all: help
 
@@ -122,8 +127,7 @@ clean: uninstall clean-build ## uninstall + wipe build caches
 
 clean-build: ## Wipe local build caches (no sudo)
 	$(RMRF) "$(STATE_DIR)" "$(CACHE_ROOT)" "$(ENROLL_UI_BUILD)"
-	@# Unquoted globs so the shell can expand dist artifacts.
-	-$(RMRF) $(REPO_ROOT)/dist/probo-agent_*.pkg
+	-$(RMRF) "$(PKG)" "$(FAT_BINARY)" "$(THIN_ARM64)" "$(THIN_AMD64)"
 	@# Native binary under /usr/local is owned by root after install; leave it
 	@# to `uninstall`. Never remove it here without sudo.
 
@@ -131,7 +135,20 @@ clean-build: ## Wipe local build caches (no sudo)
 
 pkg: $(PKG) ## Build signed .pkg into dist/
 
-$(PKG): $(PROBO_AGENT_BIN)
+$(FAT_BINARY):
+ifeq ($(UNAME_S),Darwin)
+	@$(MKDIR) "$(dir $(FAT_BINARY))"
+	CGO_ENABLED=1 GOOS=darwin GOARCH=arm64 go build $(AGENT_LDFLAGS) \
+		-o "$(THIN_ARM64)" "$(REPO_ROOT)/cmd/probo-agent"
+	CGO_ENABLED=1 GOOS=darwin GOARCH=amd64 go build $(AGENT_LDFLAGS) \
+		-o "$(THIN_AMD64)" "$(REPO_ROOT)/cmd/probo-agent"
+	lipo -create "$(THIN_ARM64)" "$(THIN_AMD64)" -output "$(FAT_BINARY)"
+else
+	@echo 'error: fat binary target is macOS-only' >&2
+	@exit 1
+endif
+
+$(PKG): $(FAT_BINARY)
 ifeq ($(UNAME_S),Darwin)
 	@if [ -z "$(CODESIGN_IDENTITY)" ]; then \
 		echo 'error: CODESIGN_IDENTITY is required' >&2; exit 2; \
@@ -139,9 +156,6 @@ ifeq ($(UNAME_S),Darwin)
 	@if [ -z "$(APPLE_TEAM_ID)" ]; then \
 		echo 'error: APPLE_TEAM_ID is required' >&2; exit 2; \
 	fi
-	@if [ -z "$(BUILD_ARCH)" ]; then \
-		echo 'error: unsupported arch $(UNAME_M)' >&2; exit 2; \
-	fi
 	@$(MKDIR) "$(dir $(PKG))"
 	@CODESIGN_IDENTITY="$(CODESIGN_IDENTITY)" \
 	APPLE_TEAM_ID="$(APPLE_TEAM_ID)" \
@@ -150,8 +164,7 @@ ifeq ($(UNAME_S),Darwin)
 	APPLE_ID_PASSWORD="$(APPLE_ID_PASSWORD)" \
 	NOTARYTOOL_KEYCHAIN_PROFILE="$(NOTARYTOOL_KEYCHAIN_PROFILE)" \
 	sh "$(MACOS_BUILD_SCRIPT)" \
-		--binary "$(PROBO_AGENT_BIN)" \
-		--arch "$(BUILD_ARCH)" \
+		--binary "$(FAT_BINARY)" \
 		--version "$(VERSION)" \
 		--output "$(PKG)"
 else
diff --git a/cmd/probo-agent/installer/macos/Distribution.xml.tmpl b/cmd/probo-agent/installer/macos/Distribution.xml.tmpl
index d4df3185b..22a4c244c 100644
--- a/cmd/probo-agent/installer/macos/Distribution.xml.tmpl
+++ b/cmd/probo-agent/installer/macos/Distribution.xml.tmpl
@@ -6,10 +6,9 @@
   Placeholders are substituted by build.sh:
 
     @@VERSION@@       agent version, e.g. 0.1.0
-    @@PKG_ARCH@@      reserved (legacy; host filter uses @@HOST_ARCHS@@)
-    @@HOST_ARCHS@@    host arch filter used by Installer.app
-                      (e.g. arm64 or arm64,x86_64 for universal)
     @@IDENTIFIER@@    package identifier (default com.probo.agent)
+
+  hostArchitectures is fixed to arm64,x86_64 (fat binary installer).
 -->
 <installer-gui-script minSpecVersion="2">
     <title>Probo Device Posture Agent @@VERSION@@</title>
@@ -22,7 +21,7 @@
     <options customize="never"
              require-scripts="true"
              rootVolumeOnly="true"
-             hostArchitectures="@@HOST_ARCHS@@"/>
+             hostArchitectures="arm64,x86_64"/>
 
     <!--
       Refuse installation on macOS older than 11 (Big Sur). The agent
diff --git a/cmd/probo-agent/installer/macos/build.sh b/cmd/probo-agent/installer/macos/build.sh
index 7cfc818ae..1cfb49c9e 100755
--- a/cmd/probo-agent/installer/macos/build.sh
+++ b/cmd/probo-agent/installer/macos/build.sh
@@ -1,15 +1,14 @@
 #!/bin/bash
 #
 # Build a Probo device posture agent macOS installer (.pkg) from a
-# pre-built `probo-agent` binary.
+# pre-built fat `probo-agent` binary (arm64 + x86_64).
 #
 # Required arguments:
-#   --binary  PATH    Path to a compiled probo-agent binary.
-#   --arch    ARCH    Target architecture: amd64, arm64, or universal.
+#   --binary  PATH    Path to a compiled probo-agent fat binary.
 #   --version VER     Agent version, e.g. 0.1.0. Defaults to the
 #                     content of cmd/probo-agent/VERSION.
 #   --output  PATH    Output .pkg path. Defaults to
-#                     dist/probo-agent_${VER}_darwin_${ARCH}.pkg.
+#                     dist/probo-agent_${VER}_darwin.pkg.
 #
 # Required environment variables:
 #   CODESIGN_IDENTITY    Developer ID Application identity. Signs the
@@ -34,18 +33,21 @@
 #
 # Must run on macOS: pkgbuild, productbuild, and swift build are
 # Apple-only tools. The build also compiles Probo Agent.app (the
-# probo:// URL handler) from enroll-ui/.
+# probo:// URL handler + privileged helper) from enroll-ui/.
 
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "${SCRIPT_DIR}/../../../.." && pwd)"
+ENROLL_UI_DIR="${SCRIPT_DIR}/enroll-ui"
 
 BINARY=""
-ARCH=""
 VERSION=""
 OUTPUT=""
 IDENTIFIER="com.probo.agent"
+APP_NAME="Probo Agent.app"
+URL_HANDLER_NAME="probo-agent-url-handler"
+HELPER_LABEL="com.probo.agent.helper"
 CODESIGN_IDENTITY="${CODESIGN_IDENTITY:-}"
 INSTALLER_IDENTITY="${INSTALLER_IDENTITY:-}"
 APPLE_ID="${APPLE_ID:-}"
@@ -60,7 +62,6 @@ usage() {
 while [ $# -gt 0 ]; do
     case "$1" in
         --binary)     BINARY="$2";     shift 2 ;;
-        --arch)       ARCH="$2";       shift 2 ;;
         --version)    VERSION="$2";    shift 2 ;;
         --output)     OUTPUT="$2";     shift 2 ;;
         --identifier) IDENTIFIER="$2"; shift 2 ;;
@@ -73,35 +74,10 @@ if [ -z "${BINARY}" ] || [ ! -x "${BINARY}" ]; then
     echo "error: --binary <path-to-probo-agent> is required and must be executable" >&2
     exit 2
 fi
-case "${ARCH}" in
-    amd64)
-        PKG_ARCH="x86_64"
-        HOST_ARCHS="x86_64"
-        OUTPUT_ARCH="x86_64"
-        ;;
-    arm64)
-        PKG_ARCH="arm64"
-        HOST_ARCHS="arm64"
-        OUTPUT_ARCH="arm64"
-        ;;
-    universal)
-        PKG_ARCH="arm64"
-        HOST_ARCHS="arm64,x86_64"
-        OUTPUT_ARCH="universal"
-        ;;
-    "")
-        echo "error: --arch (amd64|arm64|universal) is required" >&2
-        exit 2
-        ;;
-    *)
-        echo "error: unsupported --arch '${ARCH}' (want amd64, arm64, or universal)" >&2
-        exit 2
-        ;;
-esac
 
-# --arch sets hostArchitectures in Distribution.xml. Refuse a binary that
-# lacks the advertised slice(s) so Installer cannot install on a CPU the
-# agent cannot run on.
+# Distribution.xml advertises hostArchitectures=arm64,x86_64. Refuse a
+# binary that lacks either slice so Installer cannot install on a CPU
+# the agent cannot run on.
 if ! command -v lipo >/dev/null 2>&1; then
     echo "error: lipo is required to validate --binary architecture (run on macOS)" >&2
     exit 1
@@ -115,33 +91,17 @@ for arch_slice in ${BINARY_ARCHS}; do
         x86_64) has_x86_64=true ;;
     esac
 done
-case "${ARCH}" in
-    amd64)
-        if [ "${has_x86_64}" != true ]; then
-            echo "error: --arch amd64 requires a binary with an x86_64 slice (got: ${BINARY_ARCHS})" >&2
-            exit 2
-        fi
-        ;;
-    arm64)
-        if [ "${has_arm64}" != true ]; then
-            echo "error: --arch arm64 requires a binary with an arm64 slice (got: ${BINARY_ARCHS})" >&2
-            exit 2
-        fi
-        ;;
-    universal)
-        if [ "${has_arm64}" != true ] || [ "${has_x86_64}" != true ]; then
-            echo "error: --arch universal requires a fat binary with arm64 and x86_64 slices (got: ${BINARY_ARCHS}); use lipo -create" >&2
-            exit 2
-        fi
-        ;;
-esac
+if [ "${has_arm64}" != true ] || [ "${has_x86_64}" != true ]; then
+    echo "error: --binary must be a fat binary with arm64 and x86_64 slices (got: ${BINARY_ARCHS}); use lipo -create" >&2
+    exit 2
+fi
 
 if [ -z "${VERSION}" ]; then
     VERSION="$(cat "${REPO_ROOT}/cmd/probo-agent/VERSION")"
 fi
 if [ -z "${OUTPUT}" ]; then
     mkdir -p "${REPO_ROOT}/dist"
-    OUTPUT="${REPO_ROOT}/dist/probo-agent_${VERSION}_darwin_${OUTPUT_ARCH}.pkg"
+    OUTPUT="${REPO_ROOT}/dist/probo-agent_${VERSION}_darwin.pkg"
 fi
 
 if ! command -v pkgbuild >/dev/null 2>&1 || ! command -v productbuild >/dev/null 2>&1; then
@@ -170,7 +130,7 @@ if [ "${notarize_enabled}" = true ] && [ -z "${INSTALLER_IDENTITY}" ]; then
     exit 2
 fi
 
-sign_macho() {
+codesign_runtime() {
     local path="$1"
     codesign \
         --force \
@@ -181,44 +141,130 @@ sign_macho() {
     codesign --verify --verbose=2 "${path}"
 }
 
-sign_app_bundle() {
-    local app_path="$1"
-    local helper_path="${app_path}/Contents/Library/LaunchServices/com.probo.agent.helper"
-    if [ -x "${helper_path}" ]; then
-        codesign \
-            --force \
-            --options runtime \
-            --timestamp \
-            --sign "${CODESIGN_IDENTITY}" \
-            "${helper_path}"
-        codesign --verify --verbose=2 "${helper_path}"
-    fi
-    codesign \
-        --force \
-        --options runtime \
-        --timestamp \
-        --sign "${CODESIGN_IDENTITY}" \
-        "${app_path}/Contents/MacOS/probo-agent-url-handler"
-    codesign \
-        --force \
-        --options runtime \
-        --timestamp \
-        --sign "${CODESIGN_IDENTITY}" \
-        "${app_path}"
-    codesign --verify --verbose=2 "${app_path}"
+client_requirement() {
+    printf 'anchor apple generic and identifier "com.probo.agent.url-handler" and certificate leaf[subject.OU] = "%s"' "${APPLE_TEAM_ID}"
 }
 
-ensure_notarytool_credentials() {
-    if [ -z "${APPLE_ID}" ] || [ -z "${APPLE_ID_PASSWORD}" ]; then
-        echo "error: APPLE_ID and APPLE_ID_PASSWORD are required to store notarytool credentials" >&2
-        exit 2
+team_id_option() {
+    printf '"%s"' "${APPLE_TEAM_ID}"
+}
+
+# Build Probo Agent.app (URL handler + embedded privileged helper) into
+# parent_dir. Signs nested Mach-Os then the .app bundle (bottom-up).
+build_probo_agent_app() {
+    local parent_dir="$1"
+    local build_dir render_dir
+    local helper_info_plist helper_launchd_plist
+    local helper_binary url_handler_binary bin_dir
+    local app_root contents macos launch_services launch_daemons
+    local plist embedded_helper embedded_launchd
+    local helper_requirement
+    local -a helper_linker_flags swift_arch_args
+
+    build_dir="${STAGE}/enroll-ui-build"
+    render_dir="${build_dir}/rendered"
+    mkdir -p "${render_dir}"
+
+    swift_arch_args=(--arch arm64 --arch x86_64)
+
+    sed \
+        -e "s|@@VERSION@@|${VERSION}|g" \
+        "${ENROLL_UI_DIR}/Shared/HelperVersion.generated.swift.tmpl" \
+        > "${ENROLL_UI_DIR}/Shared/HelperVersion.generated.swift"
+
+    sed \
+        -e "s|@@TEAM_ID_OPTION@@|$(team_id_option)|g" \
+        "${ENROLL_UI_DIR}/Shared/SigningConstants.generated.swift.tmpl" \
+        > "${ENROLL_UI_DIR}/Shared/SigningConstants.generated.swift"
+
+    helper_info_plist="${render_dir}/helper-info.plist"
+    helper_launchd_plist="${render_dir}/helper-launchd.plist"
+
+    sed \
+        -e "s|@@VERSION@@|${VERSION}|g" \
+        -e "s|@@CLIENT_DESIGNATED_REQUIREMENT@@|$(client_requirement)|g" \
+        "${ENROLL_UI_DIR}/HelperTool/Info.plist.tmpl" > "${helper_info_plist}"
+
+    cp "${ENROLL_UI_DIR}/HelperTool/Launchd.plist.tmpl" "${helper_launchd_plist}"
+
+    helper_linker_flags=(
+        -Xlinker -sectcreate -Xlinker __TEXT -Xlinker __info_plist
+        -Xlinker "${helper_info_plist}"
+        -Xlinker -sectcreate -Xlinker __TEXT -Xlinker __launchd_plist
+        -Xlinker "${helper_launchd_plist}"
+    )
+
+    pushd "${ENROLL_UI_DIR}" >/dev/null
+    swift build -c release "${swift_arch_args[@]}" \
+        --scratch-path "${build_dir}/swift" \
+        --product "${HELPER_LABEL}" \
+        "${helper_linker_flags[@]}"
+
+    swift build -c release "${swift_arch_args[@]}" \
+        --scratch-path "${build_dir}/swift" \
+        --product "${URL_HANDLER_NAME}"
+
+    bin_dir="$(swift build -c release "${swift_arch_args[@]}" \
+        --scratch-path "${build_dir}/swift" --show-bin-path)"
+    helper_binary="${bin_dir}/${HELPER_LABEL}"
+    url_handler_binary="${bin_dir}/${URL_HANDLER_NAME}"
+    popd >/dev/null
+
+    if [ ! -x "${helper_binary}" ] || [ ! -x "${url_handler_binary}" ]; then
+        echo "error: expected release binaries were not produced" >&2
+        exit 1
     fi
-    # Password appears on argv only for this short-lived store. Submits
-    # use --keychain-profile so concurrent processes cannot read it.
-    xcrun notarytool store-credentials "${NOTARYTOOL_KEYCHAIN_PROFILE}" \
-        --apple-id "${APPLE_ID}" \
-        --password "${APPLE_ID_PASSWORD}" \
-        --team-id "${APPLE_TEAM_ID}"
+
+    app_root="${parent_dir}/${APP_NAME}"
+    contents="${app_root}/Contents"
+    macos="${contents}/MacOS"
+    launch_services="${contents}/Library/LaunchServices"
+    launch_daemons="${contents}/Library/LaunchDaemons"
+    plist="${contents}/Info.plist"
+    embedded_helper="${launch_services}/${HELPER_LABEL}"
+    embedded_launchd="${launch_daemons}/${HELPER_LABEL}.plist"
+
+    rm -rf "${app_root}"
+    mkdir -p "${macos}" "${launch_services}" "${launch_daemons}"
+
+    install -m 0755 "${url_handler_binary}" "${macos}/${URL_HANDLER_NAME}"
+    install -m 0755 "${helper_binary}" "${embedded_helper}"
+    install -m 0644 "${helper_launchd_plist}" "${embedded_launchd}"
+
+    # Sign helper before writing Info.plist so SMPrivilegedExecutables
+    # can embed the helper's designated requirement.
+    codesign_runtime "${embedded_helper}"
+    # codesign prints "Executable=…" on stderr and either
+    # "# designated => …" (modern) or "designated => …" (older) on stdout.
+    helper_requirement="$(
+        codesign -d -r- "${embedded_helper}" 2>&1 \
+            | sed -n -e 's/^# designated => //p' -e 's/^designated => //p'
+    )"
+    if [ -z "${helper_requirement}" ]; then
+        echo "error: cannot extract designated requirement from signed helper" >&2
+        codesign -d -r- "${embedded_helper}" 2>&1 >&2 || true
+        exit 1
+    fi
+    echo "Helper designated requirement: ${helper_requirement}"
+
+    sed \
+        -e "s|@@VERSION@@|${VERSION}|g" \
+        -e "s|@@HELPER_DESIGNATED_REQUIREMENT@@|${helper_requirement}|g" \
+        "${ENROLL_UI_DIR}/Info.plist.tmpl" > "${plist}"
+
+    if ! plutil -lint "${plist}" >/dev/null; then
+        echo "error: rendered Info.plist failed plutil -lint" >&2
+        exit 1
+    fi
+    if ! grep -q '<string>probo</string>' "${plist}"; then
+        echo "error: Info.plist is missing probo URL scheme" >&2
+        exit 1
+    fi
+
+    codesign_runtime "${macos}/${URL_HANDLER_NAME}"
+    codesign_runtime "${app_root}"
+
+    echo "Built ${app_root}"
 }
 
 notarytool_submit() {
@@ -228,79 +274,6 @@ notarytool_submit() {
         --wait
 }
 
-notarize_and_staple_app() {
-    local app_path="$1"
-    local zip_path
-
-    zip_path="${STAGE}/probo-agent-app.zip"
-    ditto -c -k --keepParent "${app_path}" "${zip_path}"
-    notarytool_submit "${zip_path}"
-    rm -f "${zip_path}"
-    xcrun stapler staple "${app_path}"
-}
-
-notarize_and_staple_pkg() {
-    local pkg_path="$1"
-    notarytool_submit "${pkg_path}"
-    xcrun stapler staple "${pkg_path}"
-}
-
-STAGE="$(mktemp -d -t probo-agent-pkg)"
-trap 'rm -rf "${STAGE}"' EXIT
-
-PAYLOAD="${STAGE}/payload"
-SCRIPTS="${STAGE}/scripts"
-RESOURCES="${STAGE}/Resources"
-mkdir -p "${PAYLOAD}/usr/local/bin" "${SCRIPTS}" "${RESOURCES}"
-
-install -m 0755 "${BINARY}" "${PAYLOAD}/usr/local/bin/probo-agent"
-sign_macho "${PAYLOAD}/usr/local/bin/probo-agent"
-
-mkdir -p "${PAYLOAD}/Applications"
-"${SCRIPT_DIR}/enroll-ui/build-app.sh" \
-    --arch "${ARCH}" \
-    --version "${VERSION}" \
-    --output "${PAYLOAD}/Applications"
-
-APP_PATH="${PAYLOAD}/Applications/Probo Agent.app"
-sign_app_bundle "${APP_PATH}"
-
-if [ "${notarize_enabled}" = true ]; then
-    ensure_notarytool_credentials
-    echo "Notarizing Probo Agent.app before packaging..."
-    notarize_and_staple_app "${APP_PATH}"
-fi
-
-# Avoid AppleDouble (._*) and resource-fork noise in the package.
-export COPYFILE_DISABLE=1
-
-# ditto --norsrc/--noextattr copies without resource forks / xattrs.
-ditto --norsrc --noextattr "${SCRIPT_DIR}/scripts/preinstall" "${SCRIPTS}/preinstall"
-ditto --norsrc --noextattr "${SCRIPT_DIR}/scripts/postinstall" "${SCRIPTS}/postinstall"
-ditto --norsrc --noextattr \
-    "${REPO_ROOT}/pkg/deviceagent/tray/launchagent.plist.tmpl" \
-    "${SCRIPTS}/launchagent.plist.tmpl"
-chmod 0755 "${SCRIPTS}/preinstall" "${SCRIPTS}/postinstall"
-chmod 0644 "${SCRIPTS}/launchagent.plist.tmpl"
-
-ditto --norsrc --noextattr "${SCRIPT_DIR}/Resources/welcome.html"    "${RESOURCES}/welcome.html"
-ditto --norsrc --noextattr "${SCRIPT_DIR}/Resources/conclusion.html" "${RESOURCES}/conclusion.html"
-ditto --norsrc --noextattr "${REPO_ROOT}/LICENSE"                    "${RESOURCES}/license.txt"
-
-# Strip any xattrs that tools may have reattached (codesign, etc.).
-xattr -cr "${PAYLOAD}" "${SCRIPTS}" "${RESOURCES}" 2>/dev/null || true
-find "${PAYLOAD}" "${SCRIPTS}" "${RESOURCES}" -name '._*' -delete 2>/dev/null || true
-
-# Component package: payload + scripts only.
-COMPONENT_PKG="${STAGE}/probo-agent-component.pkg"
-pkgbuild \
-    --root "${PAYLOAD}" \
-    --scripts "${SCRIPTS}" \
-    --identifier "${IDENTIFIER}" \
-    --version "${VERSION}" \
-    --install-location "/" \
-    "${COMPONENT_PKG}"
-
 # pkgbuild records protected com.apple.provenance xattrs as empty
 # AppleDouble (._*) Bom entries. Rewrite the Bom with mkbom so the
 # installer does not lay down those stubs next to real files.
@@ -331,14 +304,70 @@ rewrite_component_bom() {
     mv "${flat_pkg}" "${pkg}"
 }
 
+STAGE="$(mktemp -d -t probo-agent-pkg)"
+trap 'rm -rf "${STAGE}"' EXIT
+
+PAYLOAD="${STAGE}/payload"
+SCRIPTS="${STAGE}/scripts"
+RESOURCES="${STAGE}/Resources"
+mkdir -p "${PAYLOAD}/usr/local/bin" "${SCRIPTS}" "${RESOURCES}"
+
+install -m 0755 "${BINARY}" "${PAYLOAD}/usr/local/bin/probo-agent"
+codesign_runtime "${PAYLOAD}/usr/local/bin/probo-agent"
+
+mkdir -p "${PAYLOAD}/Applications"
+build_probo_agent_app "${PAYLOAD}/Applications"
+APP_PATH="${PAYLOAD}/Applications/${APP_NAME}"
+
+if [ "${notarize_enabled}" = true ]; then
+    # Password appears on argv only for this short-lived store. Submits
+    # use --keychain-profile so concurrent processes cannot read it.
+    xcrun notarytool store-credentials "${NOTARYTOOL_KEYCHAIN_PROFILE}" \
+        --apple-id "${APPLE_ID}" \
+        --password "${APPLE_ID_PASSWORD}" \
+        --team-id "${APPLE_TEAM_ID}"
+    echo "Notarizing Probo Agent.app before packaging..."
+    zip_path="${STAGE}/probo-agent-app.zip"
+    ditto -c -k --keepParent "${APP_PATH}" "${zip_path}"
+    notarytool_submit "${zip_path}"
+    rm -f "${zip_path}"
+    xcrun stapler staple "${APP_PATH}"
+fi
+
+# AppleDouble / xattr hygiene: COPYFILE_DISABLE + ditto --norsrc/--noextattr
+# avoid forks on copy; xattr -cr / find '._*' strip anything codesign
+# reattached; rewrite_component_bom drops provenance stubs from the Bom.
+export COPYFILE_DISABLE=1
+
+ditto --norsrc --noextattr "${SCRIPT_DIR}/scripts/preinstall" "${SCRIPTS}/preinstall"
+ditto --norsrc --noextattr "${SCRIPT_DIR}/scripts/postinstall" "${SCRIPTS}/postinstall"
+ditto --norsrc --noextattr \
+    "${REPO_ROOT}/pkg/deviceagent/tray/launchagent.plist.tmpl" \
+    "${SCRIPTS}/launchagent.plist.tmpl"
+chmod 0755 "${SCRIPTS}/preinstall" "${SCRIPTS}/postinstall"
+chmod 0644 "${SCRIPTS}/launchagent.plist.tmpl"
+
+ditto --norsrc --noextattr "${SCRIPT_DIR}/Resources/welcome.html"    "${RESOURCES}/welcome.html"
+ditto --norsrc --noextattr "${SCRIPT_DIR}/Resources/conclusion.html" "${RESOURCES}/conclusion.html"
+ditto --norsrc --noextattr "${REPO_ROOT}/LICENSE"                    "${RESOURCES}/license.txt"
+
+xattr -cr "${PAYLOAD}" "${SCRIPTS}" "${RESOURCES}" 2>/dev/null || true
+find "${PAYLOAD}" "${SCRIPTS}" "${RESOURCES}" -name '._*' -delete 2>/dev/null || true
+
+COMPONENT_PKG="${STAGE}/probo-agent-component.pkg"
+pkgbuild \
+    --root "${PAYLOAD}" \
+    --scripts "${SCRIPTS}" \
+    --identifier "${IDENTIFIER}" \
+    --version "${VERSION}" \
+    --install-location "/" \
+    "${COMPONENT_PKG}"
+
 rewrite_component_bom "${COMPONENT_PKG}"
 
-# Render Distribution.xml from its template.
 DISTRIBUTION="${STAGE}/Distribution.xml"
 sed \
     -e "s|@@VERSION@@|${VERSION}|g" \
-    -e "s|@@PKG_ARCH@@|${PKG_ARCH}|g" \
-    -e "s|@@HOST_ARCHS@@|${HOST_ARCHS}|g" \
     -e "s|@@IDENTIFIER@@|${IDENTIFIER}|g" \
     "${SCRIPT_DIR}/Distribution.xml.tmpl" > "${DISTRIBUTION}"
 
@@ -358,7 +387,8 @@ productbuild "${PRODUCTBUILD_ARGS[@]}"
 
 if [ "${notarize_enabled}" = true ]; then
     echo "Notarizing ${OUTPUT}..."
-    notarize_and_staple_pkg "${OUTPUT}"
+    notarytool_submit "${OUTPUT}"
+    xcrun stapler staple "${OUTPUT}"
 fi
 
 echo "Built ${OUTPUT}"
diff --git a/cmd/probo-agent/installer/macos/enroll-ui/.gitignore b/cmd/probo-agent/installer/macos/enroll-ui/.gitignore
index cc8601ec8..709c71f8c 100644
--- a/cmd/probo-agent/installer/macos/enroll-ui/.gitignore
+++ b/cmd/probo-agent/installer/macos/enroll-ui/.gitignore
@@ -2,5 +2,5 @@
 .build/
 .swiftpm/
 
-# Rendered by build-app.sh from *.tmpl (do not commit)
+# Rendered by build.sh from *.tmpl (do not commit)
 Shared/*.generated.swift
diff --git a/cmd/probo-agent/installer/macos/enroll-ui/Info.plist.tmpl b/cmd/probo-agent/installer/macos/enroll-ui/Info.plist.tmpl
index 06d06384c..3b11bb923 100644
--- a/cmd/probo-agent/installer/macos/enroll-ui/Info.plist.tmpl
+++ b/cmd/probo-agent/installer/macos/enroll-ui/Info.plist.tmpl
@@ -4,7 +4,7 @@
 <!--
   Info.plist for the Probo Agent URL handler app bundle.
 
-  Placeholders are substituted by build-app.sh:
+  Placeholders are substituted by build.sh:
 
     @@VERSION@@                        agent version, e.g. 0.1.0
     @@HELPER_DESIGNATED_REQUIREMENT@@  codesign requirement for embedded helper
diff --git a/cmd/probo-agent/installer/macos/enroll-ui/Shared/HelperVersion.generated.swift.tmpl b/cmd/probo-agent/installer/macos/enroll-ui/Shared/HelperVersion.generated.swift.tmpl
index 7cf2e83d6..9a3a72c24 100644
--- a/cmd/probo-agent/installer/macos/enroll-ui/Shared/HelperVersion.generated.swift.tmpl
+++ b/cmd/probo-agent/installer/macos/enroll-ui/Shared/HelperVersion.generated.swift.tmpl
@@ -1,4 +1,4 @@
-// Generated by build-app.sh — do not edit.
+// Generated by build.sh — do not edit.
 enum ProboAgentHelperVersion {
     static let value = "@@VERSION@@"
 }
diff --git a/cmd/probo-agent/installer/macos/enroll-ui/Shared/SigningConstants.generated.swift.tmpl b/cmd/probo-agent/installer/macos/enroll-ui/Shared/SigningConstants.generated.swift.tmpl
index 8ee8e8e95..50c9d03b9 100644
--- a/cmd/probo-agent/installer/macos/enroll-ui/Shared/SigningConstants.generated.swift.tmpl
+++ b/cmd/probo-agent/installer/macos/enroll-ui/Shared/SigningConstants.generated.swift.tmpl
@@ -1,4 +1,4 @@
-// Generated by build-app.sh — do not edit.
+// Generated by build.sh — do not edit.
 enum ProboAgentSigningConstants {
     static let teamID: String? = @@TEAM_ID_OPTION@@
 }
diff --git a/cmd/probo-agent/installer/macos/enroll-ui/build-app.sh b/cmd/probo-agent/installer/macos/enroll-ui/build-app.sh
deleted file mode 100755
index ba7f96310..000000000
--- a/cmd/probo-agent/installer/macos/enroll-ui/build-app.sh
+++ /dev/null
@@ -1,212 +0,0 @@
-#!/bin/bash
-#
-# Build Probo Agent.app — headless macOS app bundle with probo:// handler
-# and embedded privileged helper (installed by PKG postinstall).
-#
-# Required arguments:
-#   --arch     amd64, arm64, or universal
-#   --version  Agent version, e.g. 0.1.0
-#   --output   Parent directory; creates "Probo Agent.app" inside it
-#
-# Required environment variables:
-#   CODESIGN_IDENTITY  Developer ID Application identity. Signs the
-#                      embedded helper (for SMPrivilegedExecutables DR),
-#                      URL handler, and app bundle.
-#   APPLE_TEAM_ID      Apple Developer Team ID for SMAuthorizedClients.
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-
-ARCH=""
-VERSION=""
-OUTPUT=""
-APP_NAME="Probo Agent.app"
-URL_HANDLER_NAME="probo-agent-url-handler"
-HELPER_LABEL="com.probo.agent.helper"
-CODESIGN_IDENTITY="${CODESIGN_IDENTITY:-}"
-APPLE_TEAM_ID="${APPLE_TEAM_ID:-}"
-
-usage() {
-    sed -ne '/^#/!q; s/^# \{0,1\}//; 2,$ p' < "$0"
-}
-
-while [ $# -gt 0 ]; do
-    case "$1" in
-        --arch)    ARCH="$2";    shift 2 ;;
-        --version) VERSION="$2"; shift 2 ;;
-        --output)  OUTPUT="$2";  shift 2 ;;
-        -h|--help) usage; exit 0 ;;
-        *)         echo "unknown flag: $1" >&2; usage >&2; exit 2 ;;
-    esac
-done
-
-if [ -z "${ARCH}" ]; then
-    echo "error: --arch (amd64|arm64|universal) is required" >&2
-    exit 2
-fi
-case "${ARCH}" in
-    amd64)     SWIFT_ARCH_ARGS=(--arch x86_64) ;;
-    arm64)     SWIFT_ARCH_ARGS=(--arch arm64) ;;
-    universal) SWIFT_ARCH_ARGS=(--arch arm64 --arch x86_64) ;;
-    *)
-        echo "error: unsupported --arch '${ARCH}' (want amd64, arm64, or universal)" >&2
-        exit 2
-        ;;
-esac
-if [ -z "${VERSION}" ]; then
-    echo "error: --version is required" >&2
-    exit 2
-fi
-if [ -z "${OUTPUT}" ]; then
-    echo "error: --output is required" >&2
-    exit 2
-fi
-
-if ! command -v swift >/dev/null 2>&1; then
-    echo "error: swift is required (run on macOS with Xcode or Swift toolchain)" >&2
-    exit 1
-fi
-if [ -z "${CODESIGN_IDENTITY}" ]; then
-    echo "error: CODESIGN_IDENTITY is required (privileged helper must be signed)" >&2
-    exit 2
-fi
-if [ -z "${APPLE_TEAM_ID}" ]; then
-    echo "error: APPLE_TEAM_ID is required (SMAuthorizedClients team requirement)" >&2
-    exit 2
-fi
-
-BUILD_DIR="$(mktemp -d -t probo-agent-enroll-ui-build)"
-RENDER_DIR="${BUILD_DIR}/rendered"
-trap 'rm -rf "${BUILD_DIR}"' EXIT
-mkdir -p "${RENDER_DIR}"
-
-client_requirement() {
-    if [ -z "${APPLE_TEAM_ID}" ]; then
-        echo "error: APPLE_TEAM_ID is required (client designated requirement)" >&2
-        exit 2
-    fi
-    printf 'anchor apple generic and identifier "com.probo.agent.url-handler" and certificate leaf[subject.OU] = "%s"' "${APPLE_TEAM_ID}"
-}
-
-team_id_option() {
-    if [ -n "${APPLE_TEAM_ID}" ]; then
-        printf '"%s"' "${APPLE_TEAM_ID}"
-        return
-    fi
-    printf 'nil'
-}
-
-sed \
-    -e "s|@@VERSION@@|${VERSION}|g" \
-    "${SCRIPT_DIR}/Shared/HelperVersion.generated.swift.tmpl" \
-    > "${SCRIPT_DIR}/Shared/HelperVersion.generated.swift"
-
-sed \
-    -e "s|@@TEAM_ID_OPTION@@|$(team_id_option)|g" \
-    "${SCRIPT_DIR}/Shared/SigningConstants.generated.swift.tmpl" \
-    > "${SCRIPT_DIR}/Shared/SigningConstants.generated.swift"
-
-HELPER_INFO_PLIST="${RENDER_DIR}/helper-info.plist"
-HELPER_LAUNCHD_PLIST="${RENDER_DIR}/helper-launchd.plist"
-
-sed \
-    -e "s|@@VERSION@@|${VERSION}|g" \
-    -e "s|@@CLIENT_DESIGNATED_REQUIREMENT@@|$(client_requirement)|g" \
-    "${SCRIPT_DIR}/HelperTool/Info.plist.tmpl" > "${HELPER_INFO_PLIST}"
-
-cp "${SCRIPT_DIR}/HelperTool/Launchd.plist.tmpl" "${HELPER_LAUNCHD_PLIST}"
-
-HELPER_LINKER_FLAGS=(
-    -Xlinker -sectcreate -Xlinker __TEXT -Xlinker __info_plist
-    -Xlinker "${HELPER_INFO_PLIST}"
-    -Xlinker -sectcreate -Xlinker __TEXT -Xlinker __launchd_plist
-    -Xlinker "${HELPER_LAUNCHD_PLIST}"
-)
-
-pushd "${SCRIPT_DIR}" >/dev/null
-swift build -c release "${SWIFT_ARCH_ARGS[@]}" \
-    --scratch-path "${BUILD_DIR}/swift" \
-    --product "${HELPER_LABEL}" \
-    "${HELPER_LINKER_FLAGS[@]}"
-
-swift build -c release "${SWIFT_ARCH_ARGS[@]}" \
-    --scratch-path "${BUILD_DIR}/swift" \
-    --product "${URL_HANDLER_NAME}"
-
-BIN_DIR="$(swift build -c release "${SWIFT_ARCH_ARGS[@]}" \
-    --scratch-path "${BUILD_DIR}/swift" --show-bin-path)"
-HELPER_BINARY="${BIN_DIR}/${HELPER_LABEL}"
-URL_HANDLER_BINARY="${BIN_DIR}/${URL_HANDLER_NAME}"
-popd >/dev/null
-
-if [ ! -x "${HELPER_BINARY}" ] || [ ! -x "${URL_HANDLER_BINARY}" ]; then
-    echo "error: expected release binaries were not produced" >&2
-    exit 1
-fi
-
-APP_ROOT="${OUTPUT}/${APP_NAME}"
-CONTENTS="${APP_ROOT}/Contents"
-MACOS="${CONTENTS}/MacOS"
-LAUNCH_SERVICES="${CONTENTS}/Library/LaunchServices"
-LAUNCH_DAEMONS="${CONTENTS}/Library/LaunchDaemons"
-PLIST="${CONTENTS}/Info.plist"
-EMBEDDED_HELPER="${LAUNCH_SERVICES}/${HELPER_LABEL}"
-EMBEDDED_LAUNCHD="${LAUNCH_DAEMONS}/${HELPER_LABEL}.plist"
-
-rm -rf "${APP_ROOT}"
-mkdir -p "${MACOS}" "${LAUNCH_SERVICES}" "${LAUNCH_DAEMONS}"
-
-install -m 0755 "${URL_HANDLER_BINARY}" "${MACOS}/${URL_HANDLER_NAME}"
-install -m 0755 "${HELPER_BINARY}" "${EMBEDDED_HELPER}"
-install -m 0644 "${HELPER_LAUNCHD_PLIST}" "${EMBEDDED_LAUNCHD}"
-
-codesign \
-    --force \
-    --options runtime \
-    --timestamp \
-    --sign "${CODESIGN_IDENTITY}" \
-    "${EMBEDDED_HELPER}"
-codesign --verify --verbose=2 "${EMBEDDED_HELPER}"
-# codesign prints "Executable=…" on stderr and either
-# "# designated => …" (modern) or "designated => …" (older) on stdout.
-HELPER_REQUIREMENT="$(
-    codesign -d -r- "${EMBEDDED_HELPER}" 2>&1 \
-        | sed -n -e 's/^# designated => //p' -e 's/^designated => //p'
-)"
-if [ -z "${HELPER_REQUIREMENT}" ]; then
-    echo "error: cannot extract designated requirement from signed helper" >&2
-    codesign -d -r- "${EMBEDDED_HELPER}" 2>&1 >&2 || true
-    exit 1
-fi
-echo "Helper designated requirement: ${HELPER_REQUIREMENT}"
-
-sed \
-    -e "s|@@VERSION@@|${VERSION}|g" \
-    -e "s|@@HELPER_DESIGNATED_REQUIREMENT@@|${HELPER_REQUIREMENT}|g" \
-    "${SCRIPT_DIR}/Info.plist.tmpl" > "${PLIST}"
-
-if ! plutil -lint "${PLIST}" >/dev/null; then
-    echo "error: rendered Info.plist failed plutil -lint" >&2
-    exit 1
-fi
-if ! grep -q '<string>probo</string>' "${PLIST}"; then
-    echo "error: Info.plist is missing probo URL scheme" >&2
-    exit 1
-fi
-
-codesign \
-    --force \
-    --options runtime \
-    --timestamp \
-    --sign "${CODESIGN_IDENTITY}" \
-    "${MACOS}/${URL_HANDLER_NAME}"
-codesign \
-    --force \
-    --options runtime \
-    --timestamp \
-    --sign "${CODESIGN_IDENTITY}" \
-    "${APP_ROOT}"
-codesign --verify --verbose=2 "${APP_ROOT}"
-
-echo "Built ${APP_ROOT}"
diff --git a/contrib/claude/release/probo-agent.md b/contrib/claude/release/probo-agent.md
index 16e662480..ab090f18a 100644
--- a/contrib/claude/release/probo-agent.md
+++ b/contrib/claude/release/probo-agent.md
@@ -36,8 +36,8 @@ and FreeBSD builds stay pure Go (no tray).
 
 CI builds binaries for linux, windows, and freebsd (amd64/arm64) on
 Linux runners, and builds **CGO-enabled** darwin archives plus a
-signed/notarized **universal** `.pkg` on a macOS runner. The GitHub
-Release includes those archives, `probo-agent_*_darwin_universal.pkg`,
+signed/notarized fat `.pkg` on a macOS runner. The GitHub
+Release includes those archives, `probo-agent_*_darwin.pkg`,
 `install.sh`, signed checksums, SBOM, and build attestations. The agent
 auto-update path downloads the matching archive plus `checksums.txt` and
 verifies the cosign bundle before installing.
@@ -53,15 +53,16 @@ and the `.pkg` are built on macOS with `CGO_ENABLED=1`.
 
 Release and local builds use
 `cmd/probo-agent/installer/macos/build.sh` (requires macOS, a
-pre-built binary — preferably universal via `lipo` — and the Swift
-toolchain). **Signing is mandatory:** `CODESIGN_IDENTITY` and
-`APPLE_TEAM_ID` must be set. The script compiles `Probo Agent.app`
-(the headless `probo://` URL handler + privileged helper) from
-`cmd/probo-agent/installer/macos/enroll-ui/`, signs the binary and
-app, optionally signs the product with `INSTALLER_IDENTITY`, and
-notarizes/staples when `APPLE_ID` and `APPLE_ID_PASSWORD` are set
-(password is stored into a keychain profile; submits use
-`--keychain-profile` so the secret is not on `notarytool submit` argv).
+pre-built fat binary via `lipo`, and the Swift toolchain).
+**Signing is mandatory:** `CODESIGN_IDENTITY` and `APPLE_TEAM_ID`
+must be set. The script compiles `Probo Agent.app` (the headless
+`probo://` URL handler + privileged helper) from
+`cmd/probo-agent/installer/macos/enroll-ui/`, signs nested Mach-Os
+then the app bundle, optionally signs the product with
+`INSTALLER_IDENTITY`, and notarizes/staples when `APPLE_ID` and
+`APPLE_ID_PASSWORD` are set (password is stored into a keychain
+profile; submits use `--keychain-profile` so the secret is not on
+`notarytool submit` argv).
 
 There is no unsigned PKG path and no osascript elevation fallback.
 Local testing of browser enrollment requires a Developer ID–signed
@@ -78,7 +79,6 @@ GOOS=darwin GOARCH=amd64 CGO_ENABLED=1 go build -o dist/probo-agent_amd64 ./cmd/
 lipo -create dist/probo-agent_arm64 dist/probo-agent_amd64 -output dist/probo-agent_universal
 cmd/probo-agent/installer/macos/build.sh \
   --binary dist/probo-agent_universal \
-  --arch universal \
   --version "$(cat cmd/probo-agent/VERSION)"
 ```
 
@@ -103,7 +103,7 @@ Manual QA checklist (macOS PKG):
 4. `sudo make -C cmd/probo-agent uninstall` removes daemon, tray, helper, app, and state.
 5. MDM `/tmp/probo-agent.conf` postinstall still enrolls without a browser prompt.
 6. Notarized PKG passes Gatekeeper; `codesign --verify --deep` succeeds on the app bundle.
-7. Unsigned `build-app.sh` / `build.sh` exits with an error requiring `CODESIGN_IDENTITY`.
+7. Unsigned `build.sh` exits with an error requiring `CODESIGN_IDENTITY`.
 
 ### Apple signing secrets (GitHub)