diff --git a/.cirrus.yml b/.cirrus.yml
index 9a7f2ba..7d881f5 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -4,16 +4,6 @@ task:
   only_if: $CIRRUS_BRANCH == "main" || $CIRRUS_PR != ""
 
   matrix:
-    - name: macOS
-      macos_instance:
-        image: ghcr.io/cirruslabs/macos-runner:sequoia
-      environment:
-        CFLAGS: -pedantic -I/opt/homebrew/opt/openssl@3/include -I/opt/homebrew/include
-        LDFLAGS: -L/opt/homebrew/opt/openssl@3/lib -L/opt/homebrew/lib
-        PKG_CONFIG_PATH: /opt/homebrew/opt/openssl@3/lib/pkgconfig
-      install_script: brew update && brew install json-c libscrypt openssl python3 && env PIP_BREAK_SYSTEM_PACKAGES=1 python3 -m pip install pexpect pytest
-      test_script: uname -sr && python3 --version && mkdir build && cd build && cmake .. && cmake --build . && cmake --build . -- check && sudo cmake --build . -- install
-
     - name: clang-format
       container:
         image: silkeh/clang:19
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 27afd79..a32a35c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,6 +33,25 @@ jobs:
           cmake --build build --target check
           cmake --install build
 
+  macos:
+    runs-on: macos-26-intel
+    env:
+      CFLAGS: -pedantic -Werror -g -fno-omit-frame-pointer -fsanitize=address,undefined -fno-sanitize-recover=address,undefined
+      UBSAN_OPTIONS: print_stacktrace=1
+    steps:
+      - run: uname -rms
+      - run: python3 --version
+      - run: brew update
+      - run: brew install json-c libscrypt
+      - run: env PIP_BREAK_SYSTEM_PACKAGES=1 python3 -m pip install pexpect pytest
+      - run: echo "cloning ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}"
+      - run: git clone --no-checkout -- ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY} wd
+      - run: cd wd && git fetch -- origin ${{ github.event.pull_request.head.sha }} && git checkout FETCH_HEAD
+      - run: cmake -B build -S wd
+      - run: cmake --build build
+      - run: cmake --build build --target check
+      - run: sudo cmake --install build
+
   ubuntu2404_nogui:
     name: Ubuntu 24.04, no GTK
     runs-on: ubuntu-24.04
diff --git a/cli/check.c b/cli/check.c
index 66a4e23..ce6f05c 100644
--- a/cli/check.c
+++ b/cli/check.c
@@ -83,7 +83,7 @@ static void hash(const char *s, char hex[static SHA_DIGEST_LENGTH * 2 + 1]) {
 
   // convert the digest to hex digits
   for (size_t i = 0; i < sizeof(digest); i++)
-    sprintf(&hex[i * 2], "%02X", (int)digest[i]);
+    snprintf(&hex[i * 2], 3, "%02X", (int)digest[i]);
 }
 
 static const char *get_ssl_error(const SSL *ssl, int ret) {
@@ -237,12 +237,12 @@ static char *hibp_data(const char *hex, const char **error) {
         "Host: api.pwnedpasswords.com\r\n"
         "User-Agent: passwand <https://github.com/Smattr/passwand>\r\n"
         "\r\n")];
-    sprintf(buffer,
-            "GET /range/%.5s HTTP/1.0\r\n"
-            "Host: api.pwnedpasswords.com\r\n"
-            "User-Agent: passwand <https://github.com/Smattr/passwand>\r\n"
-            "\r\n",
-            hex);
+    snprintf(buffer, sizeof(buffer),
+             "GET /range/%.5s HTTP/1.0\r\n"
+             "Host: api.pwnedpasswords.com\r\n"
+             "User-Agent: passwand <https://github.com/Smattr/passwand>\r\n"
+             "\r\n",
+             hex);
 
     size_t len = strlen(buffer);
     size_t sent = 0;
diff --git a/gui/osascript.c b/gui/osascript.c
index 8cb27ed..890a40b 100644
--- a/gui/osascript.c
+++ b/gui/osascript.c
@@ -332,17 +332,18 @@ int send_text(const char *text) {
 
 const char *describe_output(void) { return "osascript"; }
 
-void flush_state() { /* no-op for osascript */ }
+void flush_state(void) { /* no-op for osascript */ }
 
 void show_error(const char *message) {
 
   assert(message != NULL);
 
-  bool m_needs_free = true;
-  char *m = escape(message);
-  if (m == NULL) {
+  char *const escaped = escape(message);
+  const char *m;
+  if (escaped == NULL) {
     m = "failed to allocate escaping memory";
-    m_needs_free = false;
+  } else {
+    m = escaped;
   }
 
   struct iovec iov[] = {
@@ -354,8 +355,7 @@ void show_error(const char *message) {
 
   (void)osascript(iov, sizeof(iov) / sizeof(iov[0]), NULL);
 
-  if (m_needs_free)
-    free(m);
+  free(escaped);
 }
 
 int gui_init(void) {
diff --git a/src/export.c b/src/export.c
index 5c08677..d28973c 100644
--- a/src/export.c
+++ b/src/export.c
@@ -91,12 +91,12 @@ passwand_error_t passwand_export(const char *path, passwand_entry_t *entries,
     rc = PW_OVERFLOW;
     goto done;
   }
-  tmp = malloc(strlen(path) + 2);
+  tmp = malloc(path_len + 2);
   if (tmp == NULL) {
     rc = PW_NO_MEM;
     goto done;
   }
-  sprintf(tmp, "%s~", path);
+  snprintf(tmp, path_len + 2, "%s~", path);
   int fd = open(tmp, O_CLOEXEC | O_CREAT | O_WRONLY | O_TRUNC, 0600);
   if (fd == -1) {
     rc = PW_IO;