diff --git a/apps/desktop/build/entitlements.mac.plist b/apps/desktop/build/entitlements.mac.plist
new file mode 100644
index 0000000000..043ecf496e
--- /dev/null
+++ b/apps/desktop/build/entitlements.mac.plist
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <!-- Electron's V8 / Chromium needs JIT pages writable+executable -->
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <!-- Electron reads NODE_OPTIONS / NODE_PATH at startup; the bundled executor
+         reads EXECUTOR_* env vars. Hardened runtime would strip them
+         without this entitlement. -->
+    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
+    <true/>
+    <!-- The Bun-compiled executor binary inside Resources/executor/
+         loads dylibs Apple's library validator doesn't recognize as part
+         of the Electron bundle's signing chain. -->
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+</dict>
+</plist>
diff --git a/apps/desktop/build/icon.png b/apps/desktop/build/icon.png
new file mode 100644
index 0000000000..48dadbfc58
Binary files /dev/null and b/apps/desktop/build/icon.png differ