diff --git a/electron-builder.yml b/electron-builder.yml
index 0e3f4ef..a79c196 100644
--- a/electron-builder.yml
+++ b/electron-builder.yml
@@ -6,9 +6,9 @@
 #     because native .node/dylib can't dlopen from a read-only archive and
 #     server.js process.chdir()s into its own dir;
 #   - the asar holds only the shell (electron/main.cjs + package.json);
-#   - signing/notarization config is laid now but inert until a Developer
-#     ID certificate exists (identity: null = unsigned local build, which
-#     runs fine for personal use — Gatekeeper only gates quarantined apps).
+#   - signed + notarized since 2026-10-08 (Developer ID Application cert in
+#     the login keychain; notary credentials in the LH_NOTARY keychain
+#     profile; the profile + team env vars are baked into desktop:dist).
 appId: com.learnharness.LearnHarness
 productName: LearnHarness
 directories:
@@ -55,10 +55,16 @@ extraResources:
     filter:
       - "standalone/**/*"
 mac:
+  # zip rides next to dmg (flipped 2026-10-08): Squirrel.Mac — Electron's
+  # macOS auto-updater — installs from ZIP and cannot read DMGs. DMG is
+  # for humans; ZIP + blockmap are the updater's payload.
   target:
     - target: dmg
       arch:
         - arm64
+    - target: zip
+      arch:
+        - arm64
   # Locale trim (payload wave, 2026-09-24): English-only app — cuts
   # every non-en .lproj from the frameworks (the STT/mic entitlements
   # don't depend on locales). Revisit only if localization ever lands.
@@ -71,8 +77,23 @@ mac:
     NSMicrophoneUsageDescription: "LearnHarness uses the microphone only for speech-to-text input into your sessions."
   hardenedRuntime: true
   entitlements: build/entitlements.mac.plist
-  # Unsigned until a Developer ID certificate exists (research-confirmed:
-  # local builds run fine; distribution needs signing + notarization).
-  identity: null
+  # Signing + notarization (flipped 2026-10-08): identity auto-detects the
+  # Developer ID Application certificate from the login keychain;
+  # notarize: true makes electron-builder sign → submit to Apple's notary
+  # service → staple the ticket, all inside this one build (credentials
+  # via the LH_NOTARY keychain profile, env baked into desktop:dist).
+  # Adds minutes per build (Apple's scan queue). Verification battery:
+  # codesign --verify --deep / spctl --assess / stapler validate.
+  notarize: true
 dmg:
-  title: "${productName} ${version}"
\ No newline at end of file
+  title: "${productName} ${version}"
+publish:
+  # Update feed = GitHub Releases (decided 2026-10-08): latest-mac.yml +
+  # zip/blockmap live on releases; electron-updater reads them anonymously.
+  # REQUIRES THE REPO TO BE PUBLIC before 0.3.0 ships — anonymous downloads
+  # from a private repo are impossible, and a token baked into the app
+  # would be a leak. desktop:dist passes no --publish flag, so builds never
+  # upload; publishing happens at release time (GH_TOKEN + --publish).
+  - provider: github
+    owner: amosblomqvist
+    repo: learnharness
\ No newline at end of file
diff --git a/next-env.d.ts b/next-env.d.ts
index ce4e94a..a419cbe 100644
--- a/next-env.d.ts
+++ b/next-env.d.ts
@@ -1,7 +1,7 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
-import "./.next/types/routes.d.ts";
-import "./.next/types/root-params.d.ts";
+import "./.next/dev/types/routes.d.ts";
+import "./.next/dev/types/root-params.d.ts";
 
 // NOTE: This file should not be edited
 // see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
diff --git a/package.json b/package.json
index 5149919..da0c50f 100644
--- a/package.json
+++ b/package.json
@@ -14,7 +14,7 @@
 		"typecheck": "tsc --noEmit",
 		"desktop:dev": "concurrently -k \"next dev\" \"LH_DEV_URL=http://localhost:3000 electron .\"",
 		"dev:fresh": "bash scripts/dev-fresh.sh",
-		"desktop:dist": "rm -rf dist .next/standalone && next build && node scripts/build-server.mjs && node scripts/smoke-server.mjs && electron-builder --mac --arm64"
+		"desktop:dist": "rm -rf dist .next/standalone && next build && node scripts/build-server.mjs && node scripts/smoke-server.mjs && APPLE_KEYCHAIN_PROFILE=LH_NOTARY APPLE_TEAM_ID=JS6XN22HY6 electron-builder --mac --arm64"
 	},
 	"dependencies": {
 		"@earendil-works/pi-agent-core": "1.0.2",