diff --git a/.github/workflows/build-appimage.yml b/.github/workflows/build-appimage.yml
index de6321e..99e0268 100644
--- a/.github/workflows/build-appimage.yml
+++ b/.github/workflows/build-appimage.yml
@@ -14,6 +14,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
+      attestations: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -29,7 +30,7 @@ jobs:
         with:
           version: 6.10.0
           dir: ..
-          modules: qtshadertools
+          modules: qt5compat qtshadertools
           setup-python: false
           cache: true
 
diff --git a/.github/workflows/build-dmg.yml b/.github/workflows/build-dmg.yml
index 84c0b83..37d14c0 100644
--- a/.github/workflows/build-dmg.yml
+++ b/.github/workflows/build-dmg.yml
@@ -14,6 +14,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
+      attestations: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -23,7 +24,7 @@ jobs:
         uses: jurplel/install-qt-action@v4
         with:
           version: 6.10.*
-          modules: qtshadertools
+          modules: qt5compat qtshadertools
           setup-python: true
           python-version: '3.11'
           cache: true
diff --git a/qmltermwidget b/qmltermwidget
index ed85066..7dad24f 160000
--- a/qmltermwidget
+++ b/qmltermwidget
@@ -1 +1 @@
-Subproject commit ed85066d14723303177cab663257b7b67107db62
+Subproject commit 7dad24fefb783508c5d0df52f6e7beac27d28173
diff --git a/scripts/build-dmg.sh b/scripts/build-dmg.sh
index d1bab1b..5cc7f9d 100755
--- a/scripts/build-dmg.sh
+++ b/scripts/build-dmg.sh
@@ -33,9 +33,15 @@ mkdir -p "$APP/Contents/PlugIns"
 cp -R qmltermwidget/QMLTermWidget "$PLUGIN_DST"
 
 export QML_IMPORT_PATH="$PWD/$APP/Contents/PlugIns"
-"$QT_BIN/macdeployqt" "$APP" -qmldir="$QML_DIR" -dmg
+"$QT_BIN/macdeployqt" "$APP" -qmldir="$QML_DIR"
 
 rm -f "$APP/Contents/PlugIns/sqldrivers/"libqsql{odbc,psql,mimer}.dylib 2>/dev/null || true
+
+# Remove stale signatures and ad-hoc sign so Gatekeeper doesn't report corruption.
+codesign --remove-signature "$APP" 2>/dev/null || true
+rm -rf "$APP/Contents/_CodeSignature"
+codesign --force --deep --sign - "$APP"
 DMG_OUT="${APP%.app}-${VERSION}.dmg"
-mv "$BUILD_DIR/${APP%.app}.dmg" "$OLD_CWD/$DMG_OUT"
+hdiutil create -volname "${APP%.app}" -srcfolder "$APP" -ov -format UDZO "$DMG_OUT"
+mv "$BUILD_DIR/$DMG_OUT" "$OLD_CWD/$DMG_OUT"
 popd