diff --git a/apps/desktop/.env.example b/apps/desktop/.env.example
new file mode 100644
index 0000000..77e587a
--- /dev/null
+++ b/apps/desktop/.env.example
@@ -0,0 +1,15 @@
+# Code signing
+# Get the exact value with: security find-identity -v -p codesigning
+ELECTROBUN_DEVELOPER_ID="Developer ID Application: Teh Zi Gyn (YOUR_TEAM_ID_HERE)"
+
+# Notarization - Option A: App Store Connect API key (recommended)
+# Get these at appstoreconnect.apple.com -> Users and Access -> Integrations -> API Keys -> "+"
+# ELECTROBUN_APPLEAPIISSUER="UUID from the API key page (also in the downloaded .p8 filename)"
+# ELECTROBUN_APPLEAPIKEY="8-char key ID from the API key page"
+# ELECTROBUN_APPLEAPIKEYPATH="/path/to/AuthKey_XXXXXXXXXX.p8"
+
+# Notarization - Option B: Apple ID + app-specific password
+# App-specific password: appleid.apple.com -> Sign-In and Security -> App-Specific Passwords
+# ELECTROBUN_APPLEID="you@example.com"
+# ELECTROBUN_APPLEIDPASS="xxxx-xxxx-xxxx-xxxx"
+# ELECTROBUN_TEAMID="Your Team ID (developer.apple.com -> Membership)"
diff --git a/apps/desktop/.gitignore b/apps/desktop/.gitignore
index 1257b95..199288e 100644
--- a/apps/desktop/.gitignore
+++ b/apps/desktop/.gitignore
@@ -25,3 +25,5 @@ dist-ssr
 
 .router
 artifacts
+.env
+.env.local
diff --git a/apps/desktop/electrobun.config.ts b/apps/desktop/electrobun.config.ts
index 065c4cd..a7e86a3 100644
--- a/apps/desktop/electrobun.config.ts
+++ b/apps/desktop/electrobun.config.ts
@@ -18,6 +18,8 @@ export default {
 		watchIgnore: ['dist/**'],
 		mac: {
 			bundleCEF: false,
+			codesign: true,
+			notarize: true,
 		},
 		linux: {
 			bundleCEF: false,
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index b759a14..06f63b4 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -8,10 +8,11 @@
 		"dev:hmr": "concurrently \"bun run hmr\" \"bun run start\"",
 		"hmr": "vite --port 5173",
 		"build:dev": "bun run build:native && vite build && electrobun build",
-		"build:canary": "bun run build:native && vite build && electrobun build --env=canary",
-		"build:stable": "bun run build:native && vite build && electrobun build --env=stable",
+		"build:canary": "bun run build:native && bun run sign:native && vite build && electrobun build --env=canary",
+		"build:stable": "bun run build:native && bun run sign:native && vite build && electrobun build --env=stable",
 		"build:win": "vite build && electrobun build --env=stable",
-		"build:native": "swiftc -O -o src/bun/native/biometric-helper src/bun/native/biometric-helper.swift"
+		"build:native": "swiftc -O -o src/bun/native/biometric-helper src/bun/native/biometric-helper.swift",
+		"sign:native": "bun scripts/sign-native.ts"
 	},
 	"dependencies": {
 		"@koins/utils": "workspace:*",
diff --git a/apps/desktop/scripts/sign-native.ts b/apps/desktop/scripts/sign-native.ts
new file mode 100644
index 0000000..a6377fb
--- /dev/null
+++ b/apps/desktop/scripts/sign-native.ts
@@ -0,0 +1,10 @@
+const id = process.env.ELECTROBUN_DEVELOPER_ID
+if (!id) {
+	console.error('ELECTROBUN_DEVELOPER_ID not set')
+	process.exit(1)
+}
+const r = Bun.spawnSync(
+	['codesign', '--force', '--options', 'runtime', '--timestamp', '--sign', id, 'src/bun/native/biometric-helper'],
+	{ stdout: 'inherit', stderr: 'inherit' },
+)
+process.exit(r.exitCode ?? 1)
\ No newline at end of file
diff --git a/apps/desktop/src/bun/native/biometric-helper b/apps/desktop/src/bun/native/biometric-helper
index d6875f9..cf4ea97 100755
Binary files a/apps/desktop/src/bun/native/biometric-helper and b/apps/desktop/src/bun/native/biometric-helper differ