diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 90370afd1a..74e6e1a3be 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -63,6 +63,11 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
           CMAKE_POLICY_VERSION_MINIMUM: "3.5"
 
+      - name: Verify code signature
+        run: |
+          codesign --verify --deep --strict --verbose=2 \
+            desktop/src-tauri/target/release/bundle/macos/Sprout.app
+
       - name: Locate build artifacts
         id: artifacts
         run: |
diff --git a/RELEASING.md b/RELEASING.md
index 9edc941fef..f5be698227 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -69,6 +69,17 @@ The release workflow currently builds for **macOS ARM64 only**
 (`darwin-aarch64`). Intel Mac (`darwin-x86_64`) support would require
 adding a matrix build to the workflow.
 
+## Code Signing (macOS)
+
+OSS release builds use **ad-hoc code signing** (`signingIdentity: "-"`)
+rather than a Developer ID certificate. This means the app is not
+notarized by Apple.
+
+On first launch, macOS Gatekeeper will block the app with a "damaged" or
+"unidentified developer" message. Users can bypass this by
+**right-clicking the app > Open** (or via System Settings > Privacy &
+Security). After the first launch the app will open normally.
+
 ---
 
 ## Auto-Updater
diff --git a/desktop/scripts/build-release-config.mjs b/desktop/scripts/build-release-config.mjs
index ada015f8e5..00f915bdf9 100644
--- a/desktop/scripts/build-release-config.mjs
+++ b/desktop/scripts/build-release-config.mjs
@@ -14,6 +14,10 @@ import { resolve } from "node:path";
 // 3. plugins.updater with the public key and endpoint from env vars.
 //    Both SPROUT_UPDATER_PUBLIC_KEY and SPROUT_UPDATER_ENDPOINT are required —
 //    the script fails if either is missing (OSS builds always ship with updater).
+// 4. bundle.macOS.signingIdentity = "-" for ad-hoc code signing. This
+//    prevents macOS Gatekeeper from rejecting the app as "damaged".
+//    Users will see the standard "unidentified developer" dialog on first
+//    launch, which they can bypass via right-click > Open.
 
 const outputConfigPath = resolve(
   process.cwd(),
@@ -37,6 +41,7 @@ const releaseConfig = {
   bundle: {
     macOS: {
       minimumSystemVersion: "10.15",
+      signingIdentity: "-",
     },
     createUpdaterArtifacts: true,
   },