diff --git a/scripts/ci/compile-macos.sh b/scripts/ci/compile-macos.sh
index ca42b11..e96aff3 100755
--- a/scripts/ci/compile-macos.sh
+++ b/scripts/ci/compile-macos.sh
@@ -22,22 +22,12 @@ flutter build macos --release \
 cd ..
 
 # Package .app bundle into zip
+# ditto preserves symlinks, Unix permissions, and extended attributes (code-signing).
+# Python's zipfile follows symlinks and drops permissions — do NOT use it for .app bundles.
 mkdir -p dist
-python3 - <<'PYEOF'
-import zipfile, os
-
-src = os.path.join('client', 'build', 'macos', 'Build', 'Products', 'Release', 'jiu.app')
-dst = os.path.join('dist', 'jiu-macos-x64.zip')
-
-with zipfile.ZipFile(dst, 'w', zipfile.ZIP_DEFLATED) as zf:
-    for root, dirs, files in os.walk(src):
-        for fname in files:
-            fp = os.path.join(root, fname)
-            zf.write(fp, os.path.join('jiu.app', os.path.relpath(fp, src)))
-
-size = os.path.getsize(dst)
-print(f'Packaged {dst} ({size // 1024 // 1024} MB)')
-PYEOF
+APP_SRC="client/build/macos/Build/Products/Release/jiu.app"
+ditto -c -k --keepParent "${APP_SRC}" dist/jiu-macos-x64.zip
+echo "Packaged dist/jiu-macos-x64.zip ($(du -sh dist/jiu-macos-x64.zip | cut -f1))"
 
 echo "==> compile-macos: done — dist/ contents:"
 ls -lh dist/