diff --git a/codemagic.yaml b/codemagic.yaml
index 3cfd1ec..0b48583 100644
--- a/codemagic.yaml
+++ b/codemagic.yaml
@@ -27,6 +27,20 @@ workflows:
           export PATH="$HOME/.cargo/bin:$PATH"
           PACKAGE_VERSION=$(node -p "require('./package.json').version")
           node release.js --installer --tag="v$PACKAGE_VERSION"
+      - name: Verify bundled node permissions
+        script: |
+          if [ -f "bin/node" ]; then
+            chmod +x bin/node
+            xattr -cr bin/node || true
+            ls -la bin/node
+            file bin/node
+          fi
+          APP_NODE=$(find src-tauri/target/release/bundle -name "node" -path "*bin*" 2>/dev/null | head -1)
+          if [ -n "$APP_NODE" ]; then
+            chmod +x "$APP_NODE"
+            xattr -cr "$APP_NODE" || true
+            ls -la "$APP_NODE"
+          fi
     artifacts:
       - src-tauri/target/release/bundle/dmg/*.dmg
       - src-tauri/target/release/bundle/macos/*.app
\ No newline at end of file
diff --git a/release.js b/release.js
index 53edd6b..6f79d21 100644
--- a/release.js
+++ b/release.js
@@ -295,11 +295,18 @@ function ensureBundledNode() {
                 try {
                     execSync(`tar -xzf node.tar.gz ${tarName}/bin/node`, { cwd: binDir });
 
-                    fs.renameSync(path.join(binDir, tarName, 'bin', 'node'), path.join(binDir, 'node'));
+                    const extractedNode = path.join(binDir, tarName, 'bin', 'node');
+                    const finalNode = path.join(binDir, 'node');
+
+                    fs.renameSync(extractedNode, finalNode);
                     fs.rmSync(path.join(binDir, tarName), { recursive: true, force: true });
                     fs.unlinkSync(tarPath);
 
-                    execSync(`chmod +x "${path.join(binDir, 'node')}"`, { cwd: binDir });
+                    fs.chmodSync(finalNode, 0o755);
+
+                    try {
+                        execSync(`xattr -d com.apple.quarantine "${finalNode}"`);
+                    } catch (_) { }
 
                     fs.writeFileSync(versionMarker, nodeVersion, 'utf8');
                     resolve();