diff --git a/build-app.sh b/build-app.sh
index e84f7d4..16cd180 100755
--- a/build-app.sh
+++ b/build-app.sh
@@ -7,8 +7,18 @@ swift build -c release
 BIN=".build/release/Kapture"
 APP="Kapture.app"
 CERT="kapture-dev"
+SIGN_DIR="$HOME/.config/kapture"
+KEYCHAIN="$SIGN_DIR/signing.keychain-db"
+KCHAIN_PASS="kapture-dev"
+mkdir -p "$SIGN_DIR"
 
-if ! security find-identity -p codesigning 2>/dev/null | grep -q "kapture-dev"; then
+if [ ! -f "$KEYCHAIN" ]; then
+    security create-keychain -p "$KCHAIN_PASS" "$KEYCHAIN" 2>/dev/null
+    security set-keychain-settings -lut 86400 "$KEYCHAIN"
+fi
+security unlock-keychain -p "$KCHAIN_PASS" "$KEYCHAIN" 2>/dev/null || true
+
+if ! security find-identity -p codesigning "$KEYCHAIN" 2>/dev/null | grep -q "kapture-dev"; then
     echo "Creating self-signed code signing identity '$CERT' (one-time)..."
     TMP=$(mktemp -d)
     trap 'rm -rf "$TMP"' EXIT
@@ -26,14 +36,32 @@ basicConstraints = critical, CA:true
 keyUsage = critical, digitalSignature
 extendedKeyUsage = codeSigning
 CNF
-    openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
-        -keyout "$TMP/key.pem" -out "$TMP/cert.pem" \
-        -config "$TMP/cert.cnf" 2>/dev/null
-    openssl pkcs12 -export \
-        -inkey "$TMP/key.pem" -in "$TMP/cert.pem" \
-        -out "$TMP/cert.p12" -passout pass:kapture 2>/dev/null
-    security import "$TMP/cert.p12" -k "$HOME/Library/Keychains/login.keychain-db" \
-        -P kapture -T /usr/bin/codesign 2>/dev/null
+
+    BREW_OPENSSL=""
+    if [ -x /opt/homebrew/bin/openssl ]; then
+        BREW_OPENSSL=/opt/homebrew/bin/openssl
+    elif [ -x /usr/local/bin/openssl ]; then
+        BREW_OPENSSL=/usr/local/bin/openssl
+    fi
+
+    if [ -n "$BREW_OPENSSL" ]; then
+        "$BREW_OPENSSL" req -x509 -newkey rsa:2048 -nodes -days 3650 \
+            -keyout "$TMP/key.pem" -out "$TMP/cert.pem" \
+            -config "$TMP/cert.cnf" 2>/dev/null
+        "$BREW_OPENSSL" pkcs12 -export -legacy \
+            -inkey "$TMP/key.pem" -in "$TMP/cert.pem" \
+            -out "$TMP/cert.p12" -passout pass:kapture 2>/dev/null
+        security import "$TMP/cert.p12" -k "$KEYCHAIN" \
+            -P kapture -T /usr/bin/codesign 2>/dev/null
+    else
+        openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
+            -keyout "$TMP/key.pem" -out "$TMP/cert.pem" \
+            -config "$TMP/cert.cnf" 2>/dev/null
+        openssl x509 -in "$TMP/cert.pem" -outform der -out "$TMP/cert.der" 2>/dev/null
+        openssl pkcs8 -topk8 -nocrypt -in "$TMP/key.pem" -outform der -out "$TMP/key.der" 2>/dev/null
+        security add-certificates -k "$KEYCHAIN" "$TMP/cert.der" 2>/dev/null
+        security import "$TMP/key.der" -k "$KEYCHAIN" -T /usr/bin/codesign 2>/dev/null
+    fi
 fi
 
 rm -rf "$APP"
@@ -71,11 +99,9 @@ cat > "$APP/Contents/Info.plist" <<'PLIST'
 </plist>
 PLIST
 
-codesign --force --sign "$CERT" "$APP"
-
 chmod +x scripts/make-icon.sh
 ./scripts/make-icon.sh
 
-codesign --force --sign "$CERT" "$APP"
+codesign --force --sign "$CERT" --keychain "$KEYCHAIN" "$APP"
 
 echo "Built $APP (signed with stable identity '$CERT') — drag to /Applications or run: open $APP"
diff --git a/dist/Kapture.zip b/dist/Kapture.zip
new file mode 100644
index 0000000..293cf99
Binary files /dev/null and b/dist/Kapture.zip differ
diff --git a/release.sh b/release.sh
old mode 100644
new mode 100755