diff --git a/crates/attestation/docs/operating.md b/crates/attestation/docs/operating.md
index f56218fc..13ae8426 100644
--- a/crates/attestation/docs/operating.md
+++ b/crates/attestation/docs/operating.md
@@ -10,9 +10,11 @@ There are two roles: the **provider** (serves inference on a Mac) and the
 
 Attestation only works on a genuine, locked-down Apple machine.
 
-1. **Build hardened.** Package, provision, and sign Hellas Gate. The native App
-   Attest producer lives in Gate because DeviceCheck is an app capability, not
-   a portable protocol primitive. Run with SIP enabled and Full Security boot.
+1. **Build hardened.** Package, provision, and sign Hellas Gate using its
+   [macOS signing guide](https://github.com/hellas-ai/gate/blob/52ade7b8be85835d8b43962463ff32913a638090/docs/SIGNING.md).
+   Gate owns the app bundle, signing, and native App Attest producer because
+   DeviceCheck is an app capability, not a portable protocol primitive.
+   Run with SIP enabled and Full Security boot.
 2. **Enroll (automatic).** The first time Gate starts its provider, it runs App
    Attest (`attestKey`) in the Secure Enclave and builds a
    `ProviderEnrollmentBundle` = signed genesis + the original Apple
diff --git a/macos/Info.plist b/macos/Info.plist
deleted file mode 100644
index bb7bb0da..00000000
--- a/macos/Info.plist
+++ /dev/null
@@ -1,16 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "https://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>CFBundleDisplayName</key><string>Hellas</string>
-  <key>CFBundleExecutable</key><string>hellas</string>
-  <key>CFBundleIdentifier</key><string>ai.hellas.provider</string>
-  <key>CFBundleInfoDictionaryVersion</key><string>6.0</string>
-  <key>CFBundleName</key><string>Hellas</string>
-  <key>CFBundlePackageType</key><string>APPL</string>
-  <key>CFBundleShortVersionString</key><string>0.1.0</string>
-  <key>CFBundleVersion</key><string>1</string>
-  <key>LSMinimumSystemVersion</key><string>27.0</string>
-  <key>NSPrincipalClass</key><string>NSApplication</string>
-</dict>
-</plist>
diff --git a/macos/package.sh b/macos/package.sh
deleted file mode 100755
index 04f8ea57..00000000
--- a/macos/package.sh
+++ /dev/null
@@ -1,47 +0,0 @@
-#!/bin/sh
-set -eu
-
-profile=${1:?usage: macos/package.sh PROFILE [OUTPUT.app]}
-app=${2:-target/release/Hellas.app}
-identity=${SIGN_IDENTITY:-}
-contents="$app/Contents"
-entitlements="$app.entitlements"
-sdk=$(DEVELOPER_DIR=/Library/Developer/CommandLineTools /usr/bin/xcrun --sdk macosx --show-sdk-path)
-linker=$(DEVELOPER_DIR=/Library/Developer/CommandLineTools /usr/bin/xcrun -f clang)
-
-if [ -z "$identity" ]; then
-    identity=$(security find-identity -v -p codesigning \
-        | sed -n 's/.*"\(Developer ID Application:[^"]*\)".*/\1/p' \
-        | head -n 1)
-fi
-test -n "$identity"
-test ! -e "$app"
-security cms -D -i "$profile" | plutil -extract Entitlements xml1 -o "$entitlements" -
-for entitlement in \
-    com.apple.security.get-task-allow \
-    com.apple.security.cs.allow-jit \
-    com.apple.security.cs.allow-dyld-environment-variables \
-    com.apple.security.cs.disable-library-validation \
-    com.apple.security.cs.allow-unsigned-executable-memory \
-    com.apple.security.cs.disable-executable-page-protection \
-    com.apple.security.cs.debugger
-do
-    if /usr/libexec/PlistBuddy -c "Print :$entitlement" "$entitlements" >/dev/null 2>&1; then
-        echo "error: forbidden runtime-relaxation entitlement: $entitlement" >&2
-        exit 1
-    fi
-done
-test "$(/usr/libexec/PlistBuddy -c 'Print :com.apple.developer.devicecheck.app-attest-opt-in:0' "$entitlements")" = CDhash
-application_id=$(/usr/libexec/PlistBuddy -c 'Print :com.apple.application-identifier' "$entitlements")
-bundle_id=${application_id#*.}
-
-MACOSX_DEPLOYMENT_TARGET=27.0 cargo rustc --release -p hellas-cli --features apple-app-attest,node,gateway,otel -- \
-    -C linker="$linker" -C link-arg=-isysroot -C link-arg="$sdk"
-mkdir -p "$contents/MacOS"
-cp macos/Info.plist "$contents/Info.plist"
-/usr/libexec/PlistBuddy -c "Set :CFBundleIdentifier $bundle_id" "$contents/Info.plist"
-cp target/release/hellas-cli "$contents/MacOS/hellas"
-cp "$profile" "$contents/embedded.provisionprofile"
-codesign --force --options runtime --timestamp --entitlements "$entitlements" --sign "$identity" "$app"
-codesign --verify --deep --strict --verbose=2 "$app"
-codesign -d --entitlements :- "$app" 2>/dev/null