diff --git a/packages/desktop/electron-builder.config.test.ts b/packages/desktop/electron-builder.config.test.ts
index 256a3bb2a3c..d4607cd6296 100644
--- a/packages/desktop/electron-builder.config.test.ts
+++ b/packages/desktop/electron-builder.config.test.ts
@@ -17,6 +17,12 @@ const channels = [
   { channel: "prod", appId: "ai.opencode.desktop" },
 ] as const
 
+test("signs the macOS app without signing the DMG", async () => {
+  const config = (await import("./electron-builder.config.ts?mac-signing")).default as Configuration
+  expect(config.mac?.sign).toBeFunction()
+  expect(config.dmg?.sign).not.toBe(true)
+})
+
 for (const channel of channels) {
   test(`disables security code AutoFill by default for ${channel.channel}`, async () => {
     const previous = process.env.OPENCODE_CHANNEL
diff --git a/packages/desktop/electron-builder.config.ts b/packages/desktop/electron-builder.config.ts
index 3188999bacc..3cb1302ee80 100644
--- a/packages/desktop/electron-builder.config.ts
+++ b/packages/desktop/electron-builder.config.ts
@@ -123,9 +123,6 @@ const getBase = (appId: string): Configuration => ({
     notarize: true,
     target: ["dmg", "zip"],
   },
-  dmg: {
-    sign: true,
-  },
   protocols: {
     name: "OpenCode",
     schemes: ["opencode"],