diff --git a/packaging/macos/package.sh b/packaging/macos/package.sh
index bdd644a..663d841 100755
--- a/packaging/macos/package.sh
+++ b/packaging/macos/package.sh
@@ -127,13 +127,17 @@ fi
 echo "==> building $DMG"
 STAGE="$WORK/dmg"
 mkdir -p "$STAGE"
-ditto "$APP" "$STAGE/NotesCraft.app"
+ditto --norsrc --noextattr --noacl "$APP" "$STAGE/NotesCraft.app"
 ln -s /Applications "$STAGE/Applications"
 rm -f "$DMG" "$WORK/raw.dmg"
-# makehybrid + convert builds the image without attaching a device, unlike `create -srcfolder`,
-# which is flaky on CI runners ("Resource busy") and hangs in sandboxed sessions.
-hdiutil makehybrid -hfs -hfs-volume-name "NotesCraft" -hfs-openfolder "$STAGE" -o "$WORK/raw.dmg" "$STAGE"
-hdiutil convert "$WORK/raw.dmg" -format UDZO -imagekey zlib-level=9 -o "$DMG"
+# `create -srcfolder` keeps the app bundle byte-identical (its signature still verifies from the mounted
+# image). It can fail on busy CI runners ("Resource busy"); then fall back to makehybrid, which builds the
+# image without attaching a device but stamps FinderInfo on files (the bundle then needs a re-sign after copy).
+if ! hdiutil create -srcfolder "$STAGE" -volname NotesCraft -fs HFS+ -format UDZO -imagekey zlib-level=9 -ov "$DMG"; then
+  warn "hdiutil create failed; falling back to makehybrid"
+  hdiutil makehybrid -hfs -hfs-volume-name "NotesCraft" -hfs-openfolder "$STAGE" -o "$WORK/raw.dmg" "$STAGE"
+  hdiutil convert "$WORK/raw.dmg" -format UDZO -imagekey zlib-level=9 -o "$DMG"
+fi
 rm -f "$WORK/raw.dmg"
 sign "$DMG"
 codesign --verify --strict --verbose=2 "$DMG"