diff --git a/scripts/bundle-qmd.sh b/scripts/bundle-qmd.sh
index 8fc18cf4..8bbbe5f9 100755
--- a/scripts/bundle-qmd.sh
+++ b/scripts/bundle-qmd.sh
@@ -129,11 +129,22 @@ export class LlamaChatSession {
 export const LlamaLogLevel = { Error: 0, Warn: 1, Info: 2, Debug: 3 };
 STUB
 
-# ---------- ad-hoc code signing (macOS) ----------
+# ---------- code signing (macOS) ----------
+# In CI (APPLE_SIGNING_IDENTITY set): sign with Developer ID + hardened runtime (required for notarization)
+# In dev (no identity): ad-hoc sign to remove quarantine
 if [[ "$(uname)" == "Darwin" ]] && command -v codesign &>/dev/null; then
-  echo "Ad-hoc signing bundled binaries..."
-  codesign --force --sign - "$OUT/qmd" 2>/dev/null && echo "  ✓ qmd signed" || echo "  ⚠ qmd signing failed (non-fatal)"
-  find "$OUT/node_modules" -name "*.dylib" -exec sh -c 'codesign --force --sign - "$1" 2>/dev/null && echo "  ✓ $(basename "$1") signed"' _ {} \;
+  SIGN_ID="${APPLE_SIGNING_IDENTITY:--}"
+  if [[ "$SIGN_ID" != "-" ]]; then
+    echo "Signing bundled binaries with Developer ID: $SIGN_ID"
+    SIGN_OPTS=(--force --sign "$SIGN_ID" --options runtime --timestamp)
+  else
+    echo "Ad-hoc signing bundled binaries (dev mode)..."
+    SIGN_OPTS=(--force --sign -)
+  fi
+  codesign "${SIGN_OPTS[@]}" "$OUT/qmd" 2>/dev/null && echo "  ✓ qmd signed" || echo "  ⚠ qmd signing failed (non-fatal)"
+  while IFS= read -r -d '' dylib; do
+    codesign "${SIGN_OPTS[@]}" "$dylib" 2>/dev/null && echo "  ✓ $(basename "$dylib") signed" || echo "  ⚠ $(basename "$dylib") signing failed (non-fatal)"
+  done < <(find "$OUT/node_modules" -name "*.dylib" -print0)
 fi
 
 # ---------- summary ----------
diff --git a/src/hooks/useThemeManager.test.ts b/src/hooks/useThemeManager.test.ts
index 4dbaae84..5ad52bea 100644
--- a/src/hooks/useThemeManager.test.ts
+++ b/src/hooks/useThemeManager.test.ts
@@ -371,6 +371,7 @@ describe('useThemeManager', () => {
     mockInvokeFn.mockImplementation(async (cmd: string) => {
       if (cmd === 'get_vault_settings') return { theme: 'untitled-2' }
       if (cmd === 'set_active_theme') return null
+      if (cmd === 'ensure_vault_themes') return null
       return null
     })