diff --git a/README.md b/README.md
index f2cefa6..50b9ebf 100644
--- a/README.md
+++ b/README.md
@@ -59,6 +59,16 @@ Running projects are detected through their terminal processes (`pgrep` for `--t
 | macOS     | objc2 / objc2-app-kit (Dock icon, window focus, tray) |
 | Secrets   | keyring (macOS Keychain) |
 
+## Installation
+
+Prebuilt DMGs are attached to the releases. The bundles are **not signed or notarized** — an Apple Developer ID costs €99/year, which this project doesn't have (if you'd like to change that, sponsoring is welcome). macOS therefore quarantines the download; after copying `ai-control.app` to `~/Applications`, clear it with:
+
+```sh
+xattr -d com.apple.quarantine ~/Applications/ai-control.app
+```
+
+Or avoid the topic entirely and build from source (below) — self-built apps aren't quarantined.
+
 ## Development
 
 ```sh
diff --git a/build.sh b/build.sh
index cc5b202..4d4f876 100755
--- a/build.sh
+++ b/build.sh
@@ -8,7 +8,9 @@ export RUSTUP_HOME="$HOME/tools/.rustup"
 export PATH="$CARGO_HOME/bin:$PATH"
 
 cd "$DIR"
-npm run tauri build -- --bundles app "$@"
+# CI=true: DMG ohne Finder-AppleScript (Fenster-Layout) bauen — das Script
+# wäre aus Nicht-GUI-Shells TCC-blockiert.
+CI=true npm run tauri build -- --bundles app,dmg "$@"
 
 # Dev-Bundle in ein .noindex-Verzeichnis schieben und aus Launch Services
 # austragen — Spotlight indiziert .noindex-Ordner nicht, damit erscheint im
@@ -23,3 +25,5 @@ rm -rf "$NOINDEX/ai-control.app"
 mkdir -p "$NOINDEX"
 mv "$BUNDLE/ai-control.app" "$NOINDEX/"
 "$LSREGISTER" -u "$NOINDEX/ai-control.app" || true
+
+echo "DMG: $(ls "$DIR"/src-tauri/target/release/bundle/dmg/*.dmg)"