diff --git a/.specgit.yaml b/.specgit.yaml
index 080a1b4d5..fb943af14 100644
--- a/.specgit.yaml
+++ b/.specgit.yaml
@@ -1,8 +1,8 @@
 version: 1
-delivery: add-mcp-dual
+delivery: ad-hoc-sign
 context:
   kind: branch
-  branch: test/452-add-mcp-dual
+  branch: fix/454-ad-hoc-sign
 issues:
-  - 452
-pr: 453
+  - 454
+pr: 455
diff --git a/packages/opencode/script/build.ts b/packages/opencode/script/build.ts
index 8b2e9cf02..e26402584 100755
--- a/packages/opencode/script/build.ts
+++ b/packages/opencode/script/build.ts
@@ -209,6 +209,11 @@ for (const item of targets) {
     },
   })
 
+  // macOS kills freshly compiled unsigned darwin binaries (SIGKILL 137) before they can run
+  if (process.platform === "darwin" && item.os === "darwin" && fs.existsSync("/usr/bin/codesign")) {
+    await $`codesign --force --sign - dist/${name}/bin/opencode`
+  }
+
   // Smoke test: only run if binary is for current platform
   if (item.os === process.platform && item.arch === process.arch && !item.abi) {
     const binaryPath = `dist/${name}/bin/opencode`