diff --git a/Resources/Info.plist b/Resources/Info.plist
index e001b734..6a51eb5e 100644
--- a/Resources/Info.plist
+++ b/Resources/Info.plist
@@ -38,6 +38,8 @@
 	<integer>1</integer>
 	<key>InsomniaSessionCommandVersion</key>
 	<integer>1</integer>
+	<key>InsomniaBackstopCommand</key>
+	<string>--backstop</string>
 	<key>NSHumanReadableCopyright</key>
 	<string>Copyright © 2026 Krish Garg. MIT License.</string>
 </dict>
diff --git a/SECURITY.md b/SECURITY.md
index 3bcbf397..04a4d746 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -47,8 +47,22 @@ a team id. Releases are ad-hoc signed, so both limits stay.
 
 In releases built by the Release workflow and in builds of the current
 source, the recovery LaunchAgent runs only the `backstop.sh` sealed inside the
-signed app bundle, after `codesign --verify --strict` passes against the code
-requirement pinned in its plist (the build's cdhash for an ad-hoc signature).
+signed app bundle, after strict signature and resource validation against the
+code requirement pinned in its plist (the build's cdhash for an ad-hoc
+signature). The native command uses the Security framework and directly
+executes `/bin/bash` with the sealed script path; the external fallback uses
+`codesign --verify --strict`.
+For current ad-hoc builds, launchd first enforces a `SpawnConstraint` with
+those cdhashes before starting `Insomnia --backstop`. A different binary,
+even one re-signed ad-hoc that skips the script verifier, is rejected before
+its entry point. This uses macOS launch-constraint enforcement, with System
+Integrity Protection enabled. The installer and every `arm()` require an
+affirmative `csrutil status` result before selecting native execution;
+disabled, custom, unreadable or timed-out status uses the external
+system-shell verifier, as do older bundles and requirements that cannot
+be represented entirely as cdhashes. After changing SIP, a previously
+registered native job depends on the new OS enforcement state until the
+app next arms it; changing SIP does not itself rewrite the stored plist.
 An edited bundle or script is refused and logged. The app pins the code it is
 running (its own designated requirement, after confirming that the bundle on
 disk is still that code and passes the agent's check), so a bundle edited or
diff --git a/Sources/Insomnia/Core/BackstopCommand.swift b/Sources/Insomnia/Core/BackstopCommand.swift
new file mode 100644
index 00000000..d907b3ad
--- /dev/null
+++ b/Sources/Insomnia/Core/BackstopCommand.swift
@@ -0,0 +1,31 @@
+import Darwin
+import Foundation
+
+/// Launchd starts our signed executable so Login Items can attribute the
+/// recovery agent to Insomnia, then we replace it with the verified script.
+enum BackstopCommand {
+    static let argument = "--backstop"
+
+    static func run(_ arguments: [String], bundle: URL = Bundle.main.bundleURL) -> Int32? {
+        guard arguments.first == argument else { return nil }
+        guard arguments.count == 2, !arguments[1].isEmpty, bundle.pathExtension == "app" else {
+            fputs("usage: Insomnia --backstop <code-requirement> (from Insomnia.app)\n", stderr)
+            return 64
+        }
+        do {
+            try CodeRequirement.verify(codeAt: bundle, satisfies: arguments[1])
+        } catch {
+            let reason = error.localizedDescription.replacingOccurrences(of: "\n", with: " ")
+            Log.error("backstop agent: \(bundle.path) does not satisfy the pinned code requirement; backstop.sh not run. Reinstall Insomnia (scripts/install.sh). \(reason)")
+            return 1
+        }
+        let command = ["/bin/bash", Paths.backstopScript(inBundle: bundle).path]
+        var argv = command.map { strdup($0) } + [nil]
+        defer { for argument in argv { free(argument) } }
+        return argv.withUnsafeMutableBufferPointer {
+            execv("/bin/bash", $0.baseAddress!)
+            perror("Insomnia backstop: exec /bin/bash")
+            return 1
+        }
+    }
+}
diff --git a/Sources/Insomnia/Core/LaunchdBackstop.swift b/Sources/Insomnia/Core/LaunchdBackstop.swift
index b3dcd605..7e426234 100644
--- a/Sources/Insomnia/Core/LaunchdBackstop.swift
+++ b/Sources/Insomnia/Core/LaunchdBackstop.swift
@@ -10,6 +10,9 @@ import Foundation
 /// signature against the requirement pinned in the plist and only then
 /// execs the script, so a backstop.sh edited on disk is never run by
 /// launchd. Nothing executable lives in a writable support directory.
+/// Before launching the native entry point, launchd enforces SpawnConstraint
+/// against the pinned cdhashes. A replacement binary cannot bypass the check
+/// by declining to verify the script. Older bundles use the external shell.
 ///
 /// What the app pins is the requirement of the code it is itself running
 /// (CodeRequirement.pin), after checking that the bundle on disk still is
@@ -34,6 +37,7 @@ struct BackstopTarget: Sendable, Equatable {
     /// Designated requirement of the bundle's signature, in requirement
     /// language, as `codesign -d -r-` prints it (see CodeRequirement).
     let requirement: String
+    var nativeExecutable: URL? = nil
 
     var script: URL { Paths.backstopScript(inBundle: bundle) }
 }
@@ -45,11 +49,12 @@ struct LaunchdBackstop: BackstopScheduling {
     typealias BundlePinner = @Sendable (_ bundle: URL) throws -> String
 
     static let launchctl = "/bin/launchctl"
+    static let csrutil = "/usr/bin/csrutil"
     /// Seconds between backstop.sh runs while loaded. install.sh writes the same value.
     static let pollInterval = 60
     static let commandTimeout: TimeInterval = 15
 
-    /// What launchd runs: `/bin/sh -c <agentProgram> sh <requirement> <bundle>`.
+    /// The external verifier for bundles without a constrained native command.
     /// The program verifies the bundle ($2) against the requirement ($1) with
     /// codesign and execs the sealed backstop.sh only when that passes; the
     /// resource seal covers the script, so an edited copy fails here. On
@@ -111,10 +116,28 @@ struct LaunchdBackstop: BackstopScheduling {
         } catch {
             throw BackstopError(message: "the recovery agent cannot pin \(bundle.path): \(error.localizedDescription). Reinstall with scripts/install.sh")
         }
-        let desired = Self.plistDictionary(label: label, target: BackstopTarget(bundle: bundle, requirement: requirement))
+        var executable = Self.nativeExecutable(in: bundle)
+        if executable != nil, CodeRequirement.launchHashes(in: requirement) != nil {
+            // Recheck each arm: launch constraints rely on SIP enforcement.
+            do {
+                let status = try await run(Self.csrutil, ["status"])
+                let output = status.stdout.hasSuffix("\n") ? String(status.stdout.dropLast()) : status.stdout
+                if !status.succeeded || !status.stderr.isEmpty || output != "System Integrity Protection status: enabled." {
+                    executable = nil
+                }
+            } catch is CancellationError {
+                throw CancellationError()
+            } catch {
+                executable = nil
+            }
+        }
+        let desired = Self.plistDictionary(label: label, target: BackstopTarget(
+            bundle: bundle, requirement: requirement, nativeExecutable: executable
+        ))
         // Armed when the plist the next login loads is this build's and the
         // loaded job is the one it describes: the same command line, started
-        // every `pollInterval` seconds. A loaded label alone may be another
+        // every `pollInterval` seconds, with the native spawn constraint
+        // present. A loaded label alone may be another
         // build's job, pinning a bundle or requirement this one does not
         // satisfy (install.sh can leave one loaded when it stops between its
         // bootstrap and publishing the plist), or a job loaded from a plist
@@ -137,15 +160,30 @@ struct LaunchdBackstop: BackstopScheduling {
 
     // MARK: Plist
 
+    static func nativeExecutable(in bundle: URL) -> URL? {
+        guard let data = try? Data(contentsOf: bundle.appendingPathComponent("Contents/Info.plist")),
+              let info = try? PropertyListSerialization.propertyList(from: data, format: nil) as? [String: Any],
+              info["InsomniaBackstopCommand"] as? String == BackstopCommand.argument,
+              let name = info["CFBundleExecutable"] as? String,
+              !name.isEmpty, name != ".", name != "..", !name.contains("/") else { return nil }
+        return bundle.appendingPathComponent("Contents/MacOS").appendingPathComponent(name)
+    }
+
     /// Pure builder, testable without launchd. Must produce exactly what
     /// install.sh writes, or every arm() reloads the agent.
     static func plistDictionary(label: String, target: BackstopTarget) -> [String: Any] {
-        [
+        var plist: [String: Any] = [
             "Label": label,
             "ProgramArguments": ["/bin/sh", "-c", agentProgram, "sh", target.requirement, target.bundle.path],
             "RunAtLoad": true,
             "StartInterval": pollInterval,
         ]
+        if let executable = target.nativeExecutable, let hashes = CodeRequirement.launchHashes(in: target.requirement) {
+            plist["ProgramArguments"] = [executable.path, BackstopCommand.argument, target.requirement]
+            plist["SpawnConstraint"] = ["cdhash": ["$in": hashes]]
+            plist["AssociatedBundleIdentifiers"] = [Paths.bundleIdentifier]
+        }
+        return plist
     }
 
     func plistOnDiskMatches(_ desired: [String: Any]) -> Bool {
@@ -225,15 +263,19 @@ struct LaunchdBackstop: BackstopScheduling {
         /// StartInterval in seconds; nil when the job has none, so launchd
         /// never starts it again by itself.
         var runInterval: Int?
+        /// Older native agents ran the same command without enforcing its pin.
+        var hasSpawnConstraint: Bool
 
-        init(arguments: [String], runInterval: Int?) {
+        init(arguments: [String], runInterval: Int?, hasSpawnConstraint: Bool = false) {
             self.arguments = arguments
             self.runInterval = runInterval
+            self.hasSpawnConstraint = hasSpawnConstraint
         }
 
         /// The job a plist from `plistDictionary` loads as.
         init(plist: [String: Any]) {
-            self.init(arguments: plist["ProgramArguments"] as? [String] ?? [], runInterval: plist["StartInterval"] as? Int)
+            self.init(arguments: plist["ProgramArguments"] as? [String] ?? [], runInterval: plist["StartInterval"] as? Int,
+                      hasSpawnConstraint: plist["SpawnConstraint"] != nil)
         }
     }
 
@@ -250,12 +292,14 @@ struct LaunchdBackstop: BackstopScheduling {
     /// seconds` is there only for a job with a StartInterval. nil when the
     /// arguments block is missing, repeated, unclosed or holds a line this
     /// does not know; a run interval in another form reads as none. Either
-    /// way the job does not match a plist, and arm() reloads it.
+    /// way the job does not match a plist, and arm() reloads it. The top-level
+    /// properties line reports whether the native spawn constraint is loaded.
     static func loadedJob(fromPrint output: String) -> LoadedJob? {
         let intervalPrefix = "\trun interval = ", intervalSuffix = " seconds"
         var arguments: [String]?
         var inArguments = false
         var runInterval: Int?
+        var hasSpawnConstraint = false
         for line in output.split(separator: "\n", omittingEmptySubsequences: false) {
             if inArguments {
                 if line == "\t}" {
@@ -271,10 +315,13 @@ struct LaunchdBackstop: BackstopScheduling {
                 inArguments = true
             } else if line.hasPrefix(intervalPrefix), line.hasSuffix(intervalSuffix) {
                 runInterval = Int(line.dropFirst(intervalPrefix.count).dropLast(intervalSuffix.count))
+            } else if line.hasPrefix("\tproperties = ") {
+                hasSpawnConstraint = line.dropFirst("\tproperties = ".count)
+                    .components(separatedBy: " | ").contains("has spawn constraint")
             }
         }
         guard let arguments, !inArguments else { return nil }
-        return LoadedJob(arguments: arguments, runInterval: runInterval)
+        return LoadedJob(arguments: arguments, runInterval: runInterval, hasSpawnConstraint: hasSpawnConstraint)
     }
 
     /// bootout by service target (ignored if not loaded: the trusted path may
diff --git a/Sources/Insomnia/System/CodeRequirement.swift b/Sources/Insomnia/System/CodeRequirement.swift
index 2574b16d..713c6a46 100644
--- a/Sources/Insomnia/System/CodeRequirement.swift
+++ b/Sources/Insomnia/System/CodeRequirement.swift
@@ -16,6 +16,26 @@ import Security
 /// which install.sh reads; the two must agree for the app to recognise the
 /// plist install.sh wrote (PackagingTests checks this on a scratch bundle).
 enum CodeRequirement {
+    /// Only a requirement made entirely of cdhash clauses can be enforced
+    /// before executing ad-hoc code. Keep the external shell verifier for
+    /// any other requirement instead of dropping a clause we do not know.
+    static func launchHashes(in requirement: String) -> [Data]? {
+        var hashes: [Data] = []
+        for clause in requirement.components(separatedBy: " or ") {
+            guard clause.hasPrefix("cdhash H\""), clause.hasSuffix("\"") else { return nil }
+            let hex = Array(clause.dropFirst(9).dropLast().utf8)
+            guard hex.count == 40, hex.allSatisfy({ "0123456789abcdefABCDEF".utf8.contains($0) }) else { return nil }
+            var hash = Data()
+            for offset in stride(from: 0, to: hex.count, by: 2) {
+                let pair = String(decoding: hex[offset..<(offset + 2)], as: UTF8.self)
+                guard let byte = UInt8(pair, radix: 16) else { return nil }
+                hash.append(byte)
+            }
+            hashes.append(hash)
+        }
+        return hashes
+    }
+
     struct ReadError: LocalizedError {
         let path: String
         let step: String
diff --git a/Sources/Insomnia/main.swift b/Sources/Insomnia/main.swift
index 490cfb0e..e0c578c2 100644
--- a/Sources/Insomnia/main.swift
+++ b/Sources/Insomnia/main.swift
@@ -1,10 +1,15 @@
 import Foundation
 
-// Entry point. A one-shot command-line mode is answered here, before AppKit
-// or SwiftUI start: backstop.sh borrows the app's kernel-level identity
-// check (see ResumeFrozenCommand), which ends itself when its lifetime is
-// up, and scripts drive the running app's session (see SessionCommandLine).
-// Anything else starts the menu bar app.
+// Entry point. One-shot command-line modes are answered here, before AppKit
+// or SwiftUI start: the recovery agent's backstop mode execs the verified
+// script (see BackstopCommand), backstop.sh borrows the app's kernel-level
+// identity check (see ResumeFrozenCommand), which ends itself when its
+// lifetime is up, and scripts drive the running app's session (see
+// SessionCommandLine). Anything else starts the menu bar app.
+if let status = BackstopCommand.run(Array(CommandLine.arguments.dropFirst())) {
+    exit(status)
+}
+
 if let output = ResumeFrozenCommand.run(Array(CommandLine.arguments.dropFirst()), endAfter: ResumeFrozenCommand.endProcess) {
     for line in output.lines { print(line) }
     exit(output.status)
diff --git a/Tests/InsomniaTests/LaunchdBackstopTests.swift b/Tests/InsomniaTests/LaunchdBackstopTests.swift
index 0f3235cf..b1d1b1c0 100644
--- a/Tests/InsomniaTests/LaunchdBackstopTests.swift
+++ b/Tests/InsomniaTests/LaunchdBackstopTests.swift
@@ -10,8 +10,12 @@ final class LaunchdBackstopTests: XCTestCase {
     /// fake reader below hands it out for the fixture bundle.
     static let requirement = "cdhash H\"0f1e2d3c4b5a69788796a5b4c3d2e1f00f1e2d3c\""
     var home: TempHome!
-    /// (exe, args) of every command the backstop ran.
+    /// (exe, args) of every launchctl command the backstop ran.
     let calls = Locked<[[String]]>([])
+    let integrityStatus = Locked(ShellResult(status: 0, stdout: "System Integrity Protection status: enabled.\n", stderr: ""))
+    let integrityReadFails = Locked(false)
+    let integrityReadCancelled = Locked(false)
+    let integrityReads = Locked(0)
     /// Whether `launchctl print` reports the job loaded.
     let loaded = Locked(false)
     /// The ProgramArguments of the plist the loaded job was bootstrapped
@@ -19,6 +23,8 @@ final class LaunchdBackstopTests: XCTestCase {
     let loadedJob = Locked<[String]>([])
     /// Its StartInterval, which `launchctl print` lists as `run interval`.
     let loadedInterval = Locked<Int?>(nil)
+    let loadedConstraint = Locked(false)
+    let printedJob = Locked<String?>(nil)
     let bootstrapFails = Locked(false)
     /// bootout returns an error and leaves the job loaded, as launchd does
     /// for a job that is mid-transition.
@@ -34,9 +40,15 @@ final class LaunchdBackstopTests: XCTestCase {
     override func setUp() {
         home = TempHome()
         calls.value = []
+        integrityStatus.value = ShellResult(status: 0, stdout: "System Integrity Protection status: enabled.\n", stderr: "")
+        integrityReadFails.value = false
+        integrityReadCancelled.value = false
+        integrityReads.value = 0
         loaded.value = false
         loadedJob.value = []
         loadedInterval.value = nil
+        loadedConstraint.value = false
+        printedJob.value = nil
         bootstrapFails.value = false
         bootoutFails.value = false
         onBootout.value = nil
@@ -56,9 +68,14 @@ final class LaunchdBackstopTests: XCTestCase {
             let script = home.paths.backstopScript
             try FileManager.default.createDirectory(at: script.deletingLastPathComponent(), withIntermediateDirectories: true)
             try Data("#!/bin/bash\n".utf8).write(to: script)
+            let info: [String: Any] = ["InsomniaBackstopCommand": BackstopCommand.argument, "CFBundleExecutable": "Insomnia"]
+            try PropertyListSerialization.data(fromPropertyList: info, format: .xml, options: 0)
+                .write(to: home.paths.appBundle.appendingPathComponent("Contents/Info.plist"))
         }
-        let calls = calls, loaded = loaded, loadedJob = loadedJob, loadedInterval = loadedInterval, bootstrapFails = bootstrapFails, bootoutFails = bootoutFails
+        let calls = calls, loaded = loaded, loadedJob = loadedJob, loadedInterval = loadedInterval, loadedConstraint = loadedConstraint, bootstrapFails = bootstrapFails, bootoutFails = bootoutFails
+        let integrityStatus = integrityStatus, integrityReadFails = integrityReadFails, integrityReadCancelled = integrityReadCancelled, integrityReads = integrityReads
         let onBootout = onBootout, onBootstrapped = onBootstrapped, trustedPlistAtBootstrap = trustedPlistAtBootstrap
+        let printedJob = printedJob
         let trusted = home.paths.backstopPlist
         let label = "com.insomnia.backstop"
         // What launchd itself enforces on a path argument (proven against a
@@ -85,11 +102,18 @@ final class LaunchdBackstopTests: XCTestCase {
             return requirement
         }
         return LaunchdBackstop(paths: home.paths, bundle: bundle, pin: pin, uid: 501) { exe, args in
+            if exe == LaunchdBackstop.csrutil {
+                integrityReads.value += 1
+                XCTAssertEqual(args, ["status"])
+                if integrityReadCancelled.value { throw CancellationError() }
+                if integrityReadFails.value { throw BackstopError(message: "status unavailable") }
+                return integrityStatus.value
+            }
             calls.value.append([exe] + args)
             switch args.first {
             case "print":
                 guard loaded.value else { return ShellResult(status: 113, stdout: "", stderr: "Could not find service") }
-                return ShellResult(status: 0, stdout: Self.printOutput(arguments: loadedJob.value, runInterval: loadedInterval.value), stderr: "")
+                return ShellResult(status: 0, stdout: printedJob.value ?? Self.printOutput(arguments: loadedJob.value, runInterval: loadedInterval.value, hasSpawnConstraint: loadedConstraint.value), stderr: "")
             case "bootstrap":
                 trustedPlistAtBootstrap.value.append(try? Data(contentsOf: trusted))
                 guard args.count == 3, launchdAccepts(args[2]) else {
@@ -103,6 +127,7 @@ final class LaunchdBackstopTests: XCTestCase {
                     .flatMap { try? PropertyListSerialization.propertyList(from: $0, format: nil) as? [String: Any] }
                 loadedJob.value = plist?["ProgramArguments"] as? [String] ?? []
                 loadedInterval.value = plist?["StartInterval"] as? Int
+                loadedConstraint.value = plist?["SpawnConstraint"] != nil
                 if let hook = onBootstrapped.value { onBootstrapped.value = nil; hook() }
                 return ShellResult(status: 0, stdout: "", stderr: "")
             case "bootout":
@@ -124,11 +149,77 @@ final class LaunchdBackstopTests: XCTestCase {
         }
     }
 
+    /// Captured from a disposable native job using the generated constraint.
+    /// Paths, identifiers, hashes and numeric IDs are replaced; layout and
+    /// properties are launchctl's actual output, not inferred from the plist.
+    static let capturedNative = """
+    gui/502/com.insomnia.spawn-probe.fixture = {
+    \tactive count = 0
+    \tpath = /private/tmp/insomnia-spawn-probe-fixture/com.insomnia.spawn-probe.fixture.plist
+    \ttype = LaunchAgent
+    \tstate = not running
+
+    \tprogram = /private/tmp/insomnia-spawn-probe-fixture/Insomnia Probe.app/Contents/MacOS/Insomnia
+    \targuments = {
+    \t\t/private/tmp/insomnia-spawn-probe-fixture/Insomnia Probe.app/Contents/MacOS/Insomnia
+    \t\t--backstop
+    \t\tcdhash H"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+    \t}
+
+    \tinherited environment = {
+    \t\tSSH_AUTH_SOCK => /private/tmp/com.apple.launchd.fixture/Listeners
+    \t}
+
+    \tdefault environment = {
+    \t\tPATH => /usr/bin:/bin:/usr/sbin:/sbin
+    \t}
+
+    \tenvironment = {
+    \t\tOSLogRateLimit => 64
+    \t\tXPC_SERVICE_NAME => com.insomnia.spawn-probe.fixture
+    \t}
+
+    \tdomain = gui/502 [100000]
+    \tasid = 100000
+    \tminimum runtime = 10
+    \texit timeout = 5
+    \truns = 1
+    \tlast exit code = 0
+
+    \tresource coalition = {
+    \t\tID = 100
+    \t\ttype = resource
+    \t\tstate = active
+    \t\tactive count = 1
+    \t\tname = com.insomnia.spawn-probe.fixture
+    \t}
+
+    \tjetsam coalition = {
+    \t\tID = 101
+    \t\ttype = jetsam
+    \t\tstate = active
+    \t\tactive count = 1
+    \t\tname = com.insomnia.spawn-probe.fixture
+    \t}
+
+    \tspawn type = daemon (3)
+    \tjetsam priority = 40
+    \tjetsam memory limit (active) = (unlimited)
+    \tjetsam memory limit (inactive) = (unlimited)
+    \tjetsamproperties category = daemon
+    \tjetsam thread limit = 32
+    \tcpumon = default
+    \trun interval = 60 seconds
+
+    \tproperties = runatload | inferred program | has spawn constraint
+    }
+    """
+
     /// `launchctl print gui/501/<label>` for a loaded job, in the layout
     /// launchctl prints (checked 2026-10-02): top-level keys indented by one
     /// tab, each argument on its own line indented by two, and `run
     /// interval` only for a job with a StartInterval.
-    static func printOutput(arguments: [String], runInterval: Int?) -> String {
+    static func printOutput(arguments: [String], runInterval: Int?, hasSpawnConstraint: Bool = false) -> String {
         """
         gui/501/com.insomnia.backstop = {
         \tactive count = 0
@@ -147,7 +238,7 @@ final class LaunchdBackstopTests: XCTestCase {
         \tdomain = gui/501 [100022]
         \tcpumon = default
         \(runInterval.map { "\trun interval = \($0) seconds\n" } ?? "")
-        \tproperties = runatload | inferred program | managed LWCR | has LWCR
+        \tproperties = runatload | inferred program | managed LWCR | has LWCR\(hasSpawnConstraint ? " | has spawn constraint" : "")
         }
 
         """
@@ -198,20 +289,50 @@ final class LaunchdBackstopTests: XCTestCase {
     }
 
     private var expectedArguments: [String] {
-        ["/bin/sh", "-c", LaunchdBackstop.agentProgram, "sh", Self.requirement, home.paths.appBundle.path]
+        [home.paths.appBundle.appendingPathComponent("Contents/MacOS/Insomnia").path, "--backstop", Self.requirement]
     }
 
     func testPlistIsAPersistentPollingAgentThatVerifiesTheBundleFirst() {
-        let target = BackstopTarget(bundle: URL(fileURLWithPath: "/x/Insomnia.app", isDirectory: true), requirement: "cdhash H\"ab\"")
+        let target = BackstopTarget(bundle: URL(fileURLWithPath: "/x/Insomnia.app", isDirectory: true), requirement: Self.requirement, nativeExecutable: URL(fileURLWithPath: "/x/Insomnia.app/Contents/MacOS/Insomnia"))
         let d = LaunchdBackstop.plistDictionary(label: "com.insomnia.backstop", target: target)
         XCTAssertEqual(d["Label"] as? String, "com.insomnia.backstop")
-        XCTAssertEqual(d["ProgramArguments"] as? [String], ["/bin/sh", "-c", LaunchdBackstop.agentProgram, "sh", "cdhash H\"ab\"", "/x/Insomnia.app"])
+        XCTAssertEqual(d["ProgramArguments"] as? [String], ["/x/Insomnia.app/Contents/MacOS/Insomnia", "--backstop", Self.requirement])
+        XCTAssertEqual(d["AssociatedBundleIdentifiers"] as? [String], [Paths.bundleIdentifier])
+        let constraint = d["SpawnConstraint"] as? [String: [String: [Data]]]
+        XCTAssertEqual(constraint?["cdhash"]?["$in"], CodeRequirement.launchHashes(in: Self.requirement))
         XCTAssertEqual(d["RunAtLoad"] as? Bool, true)
         XCTAssertEqual(d["StartInterval"] as? Int, 60)
         XCTAssertNil(d["StartCalendarInterval"], "a per-deadline trigger would need a reload per extension")
         XCTAssertEqual(target.script.path, "/x/Insomnia.app/Contents/Resources/backstop.sh")
     }
 
+    func testSpawnHashesRequireEveryClauseToBeAnExactCdHash() {
+        let other = "cdhash H\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\""
+        XCTAssertEqual(CodeRequirement.launchHashes(in: Self.requirement + " or " + other)?.count, 2)
+        XCTAssertEqual(CodeRequirement.launchHashes(in: other), [Data(repeating: 0xaa, count: 20)])
+        for invalid in ["", "cdhash H\"ab\"", "cdhash H\"+1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"",
+                        Self.requirement + " or always", Self.requirement + " and anchor apple",
+                        "identifier com.kgarg.insomnia and anchor apple generic"] {
+            XCTAssertNil(CodeRequirement.launchHashes(in: invalid), invalid)
+        }
+    }
+
+    func testUnknownRequirementsKeepTheExternalVerifier() {
+        let target = BackstopTarget(bundle: home.paths.appBundle, requirement: "identifier com.kgarg.insomnia",
+                                    nativeExecutable: home.paths.appBundle.appendingPathComponent("Contents/MacOS/Insomnia"))
+        let plist = LaunchdBackstop.plistDictionary(label: "com.insomnia.backstop", target: target)
+        XCTAssertEqual((plist["ProgramArguments"] as? [String])?.first, "/bin/sh")
+        XCTAssertNil(plist["SpawnConstraint"])
+    }
+
+    func testNativeExecutableComesFromTheBundleMetadata() throws {
+        _ = try makeBackstop()
+        let info: [String: Any] = ["InsomniaBackstopCommand": BackstopCommand.argument, "CFBundleExecutable": "Custom helper"]
+        try PropertyListSerialization.data(fromPropertyList: info, format: .xml, options: 0)
+            .write(to: home.paths.appBundle.appendingPathComponent("Contents/Info.plist"))
+        XCTAssertEqual(LaunchdBackstop.nativeExecutable(in: home.paths.appBundle)?.lastPathComponent, "Custom helper")
+    }
+
     /// The program itself: verify the bundle ($2) against the requirement
     /// ($1), exec the sealed script only then, and never run anything else.
     /// PackagingTests runs it against a real signed bundle; this pins the
@@ -279,6 +400,82 @@ final class LaunchdBackstopTests: XCTestCase {
         XCTAssertTrue(loaded.value)
     }
 
+    func testVerifiedShellAgentIsMigratedToTheAppExecutable() async throws {
+        let b = try makeBackstop()
+        let arguments = ["/bin/sh", "-c", LaunchdBackstop.agentProgram, "sh", Self.requirement, home.paths.appBundle.path]
+        try writePlist(["Label": "com.insomnia.backstop", "ProgramArguments": arguments, "RunAtLoad": true, "StartInterval": 60])
+        loaded.value = true
+        loadedJob.value = arguments
+        loadedInterval.value = 60
+        try await b.arm()
+        XCTAssertEqual(calls.value.map { $0[1] }, ["bootout", "bootstrap"])
+        XCTAssertEqual(try plistOnDisk()["ProgramArguments"] as? [String], expectedArguments)
+        XCTAssertEqual(try plistOnDisk()["AssociatedBundleIdentifiers"] as? [String], [Paths.bundleIdentifier])
+    }
+
+    func testDevelopmentBuildKeepsTheExternalVerifierForAnOlderInstalledBundle() async throws {
+        let b = try makeBackstop()
+        try FileManager.default.removeItem(at: home.paths.appBundle.appendingPathComponent("Contents/Info.plist"))
+        try await b.arm()
+        XCTAssertEqual(try plistOnDisk()["ProgramArguments"] as? [String],
+                       ["/bin/sh", "-c", LaunchdBackstop.agentProgram, "sh", Self.requirement, home.paths.appBundle.path])
+        XCTAssertNil(try plistOnDisk()["SpawnConstraint"])
+    }
+
+    func testLoadedNativeJobWithoutTheConstraintIsReloaded() async throws {
+        let b = try makeBackstop()
+        try await b.arm()
+        loadedConstraint.value = false
+        calls.value = []
+        try await b.arm()
+        XCTAssertEqual(calls.value.map { $0[1] }, ["print", "bootout", "bootstrap"])
+        XCTAssertTrue(loadedConstraint.value)
+    }
+
+    func testArmUsesTheExternalVerifierUnlessSIPIsKnownEnabled() async throws {
+        let b = try makeBackstop()
+        for status in [
+            ShellResult(status: 0, stdout: "System Integrity Protection status: disabled.\n", stderr: ""),
+            ShellResult(status: 0, stdout: "System Integrity Protection status: unknown (Custom Configuration).\n", stderr: ""),
+            ShellResult(status: 0, stdout: "", stderr: ""),
+            ShellResult(status: 1, stdout: "System Integrity Protection status: enabled.\n", stderr: "failed"),
+            ShellResult(status: 0, stdout: "System Integrity Protection status: enabled.\n", stderr: "unexpected diagnostic"),
+        ] {
+            integrityStatus.value = status
+            try await b.arm()
+            XCTAssertEqual(try plistOnDisk()["ProgramArguments"] as? [String],
+                           ["/bin/sh", "-c", LaunchdBackstop.agentProgram, "sh", Self.requirement, home.paths.appBundle.path])
+            XCTAssertNil(try plistOnDisk()["SpawnConstraint"])
+        }
+        integrityReadFails.value = true
+        try await b.arm()
+        XCTAssertNil(try plistOnDisk()["SpawnConstraint"])
+    }
+
+    func testArmRechecksSIPAndReplacesTheNativeAgentWhenDisabled() async throws {
+        let b = try makeBackstop()
+        try await b.arm()
+        XCTAssertNotNil(try plistOnDisk()["SpawnConstraint"])
+        integrityStatus.value = ShellResult(status: 0, stdout: "System Integrity Protection status: disabled.\n", stderr: "")
+        calls.value = []
+        try await b.arm()
+        XCTAssertEqual(calls.value.map { $0[1] }, ["bootout", "bootstrap"])
+        XCTAssertNil(try plistOnDisk()["SpawnConstraint"])
+        XCTAssertEqual(loadedJob.value.first, "/bin/sh")
+        XCTAssertEqual(integrityReads.value, 2)
+    }
+
+    func testCancellationDuringSIPReadDoesNotReplaceTheAgent() async throws {
+        let b = try makeBackstop()
+        integrityReadCancelled.value = true
+        do {
+            try await b.arm()
+            XCTFail("cancelled read was ignored")
+        } catch is CancellationError {}
+        XCTAssertTrue(calls.value.isEmpty)
+        XCTAssertFalse(FileManager.default.fileExists(atPath: home.paths.backstopPlist.path))
+    }
+
     /// After an upgrade the bundle's requirement changes (a new ad-hoc
     /// cdhash). The plist pinning the previous build would make the agent
     /// refuse the new bundle, so the first arm() of the new build reloads it.
@@ -364,8 +561,12 @@ final class LaunchdBackstopTests: XCTestCase {
         let b = try makeBackstop()
         try await b.arm()
         calls.value = []
+        printedJob.value = Self.capturedNative
+            .replacingOccurrences(of: "/private/tmp/insomnia-spawn-probe-fixture/Insomnia Probe.app/Contents/MacOS/Insomnia", with: expectedArguments[0])
+            .replacingOccurrences(of: "cdhash H\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"", with: Self.requirement)
         try await b.arm()
         XCTAssertEqual(calls.value, [["/bin/launchctl", "print", "gui/501/com.insomnia.backstop"]], "a loaded agent was reloaded, opening a window with no agent")
+        XCTAssertEqual(integrityReads.value, 2)
     }
 
     /// Plist current but the job not loaded (logged out and in without the
@@ -403,7 +604,7 @@ final class LaunchdBackstopTests: XCTestCase {
         let b = try makeBackstop()
         try await b.arm()
         let trusted = try Data(contentsOf: home.paths.backstopPlist)
-        loadedJob.value = ["/bin/sh", "-c", LaunchdBackstop.agentProgram, "sh", "cdhash H\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"", home.paths.appBundle.path]
+        loadedJob.value = [home.paths.appBundle.appendingPathComponent("Contents/MacOS/Insomnia").path, "--backstop", "cdhash H\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\""]
         calls.value = []
 
         try await b.arm()
@@ -426,8 +627,12 @@ final class LaunchdBackstopTests: XCTestCase {
     /// has no StartInterval.
     func testLoadedJobIsReadFromLaunchctlsLayout() {
         XCTAssertEqual(
-            LaunchdBackstop.loadedJob(fromPrint: Self.printOutput(arguments: expectedArguments, runInterval: 60)),
-            LaunchdBackstop.LoadedJob(arguments: expectedArguments, runInterval: 60)
+            LaunchdBackstop.loadedJob(fromPrint: Self.capturedNative),
+            LaunchdBackstop.LoadedJob(arguments: ["/private/tmp/insomnia-spawn-probe-fixture/Insomnia Probe.app/Contents/MacOS/Insomnia", "--backstop", "cdhash H\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\""], runInterval: 60, hasSpawnConstraint: true)
+        )
+        XCTAssertEqual(
+            LaunchdBackstop.loadedJob(fromPrint: Self.printOutput(arguments: expectedArguments, runInterval: 60, hasSpawnConstraint: true)),
+            LaunchdBackstop.LoadedJob(arguments: expectedArguments, runInterval: 60, hasSpawnConstraint: true)
         )
         let captured = """
         gui/501/com.insomnia.backstop = {
diff --git a/Tests/InsomniaTests/PackagingTests.swift b/Tests/InsomniaTests/PackagingTests.swift
index 95bb3648..e3ab5d5a 100644
--- a/Tests/InsomniaTests/PackagingTests.swift
+++ b/Tests/InsomniaTests/PackagingTests.swift
@@ -118,14 +118,16 @@ final class PackagingTests: XCTestCase {
     /// A throwaway bundle laid out the way install.sh lays out Insomnia.app
     /// (Mach-O main executable, Info.plist, backstop.sh under
     /// Contents/Resources), ad-hoc signed afterwards so the resource seal
-    /// covers the script. The executable is a copy of /usr/bin/true. Nothing
+    /// covers the script. The executable is a copy of the built Insomnia. Nothing
     /// here touches an installed app, a LaunchAgent or a keychain.
     private func makeSignedBundle(named name: String = "Insomnia") throws -> URL {
         let fm = FileManager.default
         let bundle = scratch.appendingPathComponent("\(name).app", isDirectory: true)
         try fm.createDirectory(at: bundle.appendingPathComponent("Contents/MacOS"), withIntermediateDirectories: true)
         try fm.createDirectory(at: bundle.appendingPathComponent("Contents/Resources"), withIntermediateDirectories: true)
-        try fm.copyItem(atPath: "/usr/bin/true", toPath: bundle.appendingPathComponent("Contents/MacOS/\(name)").path)
+        let binary = Bundle(for: Self.self).bundleURL.deletingLastPathComponent().appendingPathComponent("Insomnia")
+        _ = try XCTUnwrap(fm.isExecutableFile(atPath: binary.path) ? binary : nil, "Build the Insomnia product before running packaging tests; expected \(binary.path)")
+        try fm.copyItem(at: binary, to: bundle.appendingPathComponent("Contents/MacOS/\(name)"))
         let info: [String: Any] = [
             "CFBundleExecutable": name, "CFBundleIdentifier": "com.kgarg.insomnia.packaging-test",
             "CFBundlePackageType": "APPL", "CFBundleShortVersionString": "0.0.1",
@@ -139,11 +141,72 @@ final class PackagingTests: XCTestCase {
         return bundle
     }
 
+    /// The two command lines the LaunchAgent can run. `native` is the app's
+    /// `--backstop` mode. `shell` is the external verifier the plist falls
+    /// back to for an older bundle, a requirement without cdhashes, or SIP
+    /// not known to be enabled. Both refuse the same bundles, but the app
+    /// logs through Log with Security's reason and the shell logs to
+    /// ~/Library/Logs/Insomnia with codesign's.
+    private enum AgentLauncher {
+        case native, shell
+
+        var log: String { self == .native ? "Logs/insomnia.log" : "Library/Logs/Insomnia/insomnia.log" }
+        var refusal: String { self == .native ? "[error] insomnia: backstop agent: " : "[error] backstop agent: " }
+        var editedScriptReason: String { self == .native ? securityMessage(errSecCSBadResource) : "sealed resource" }
+        var wrongBuildReason: String { self == .native ? securityMessage(errSecCSReqFailed) : "failed to satisfy specified code requirement" }
+    }
+
     /// Runs the agent's command line exactly as launchd would, with HOME in
-    /// the scratch tree so the refusal log lands there.
-    private func runAgent(requirement: String, bundle: URL, home: URL) throws -> (status: Int32, output: String) {
+    /// the scratch tree so the refusal log lands there. The shell command
+    /// line is the one plistDictionary writes for a target without a native
+    /// executable.
+    private func runAgent(_ launcher: AgentLauncher = .native, requirement: String, bundle: URL, home: URL) throws -> (status: Int32, output: String) {
         try FileManager.default.createDirectory(at: home, withIntermediateDirectories: true)
-        return try run("/bin/sh", ["-c", LaunchdBackstop.agentProgram, "sh", requirement, bundle.path], environment: ["HOME": home.path, "PATH": "/usr/bin:/bin"])
+        switch launcher {
+        case .native:
+            return try run(bundle.appendingPathComponent("Contents/MacOS/\(bundle.deletingPathExtension().lastPathComponent)").path,
+                           ["--backstop", requirement], environment: ["HOME": home.path, "INSOMNIA_HOME": home.path, "PATH": "/usr/bin:/bin"])
+        case .shell:
+            let plist = LaunchdBackstop.plistDictionary(label: Paths.backstopLabel, target: BackstopTarget(bundle: bundle, requirement: requirement))
+            let arguments = try XCTUnwrap(plist["ProgramArguments"] as? [String])
+            XCTAssertEqual(arguments.prefix(3), ["/bin/sh", "-c", LaunchdBackstop.agentProgram])
+            return try run(arguments[0], Array(arguments.dropFirst()), environment: ["HOME": home.path, "PATH": "/usr/bin:/bin"])
+        }
+    }
+
+    func testBackstopModeRejectsMalformedArgumentsWithoutStartingTheApp() throws {
+        let bundle = try makeSignedBundle()
+        let executable = bundle.appendingPathComponent("Contents/MacOS/Insomnia").path
+        for arguments in [["--backstop"], ["--backstop", ""], ["--backstop", "x", "extra"]] {
+            let result = try run(executable, arguments)
+            XCTAssertEqual(result.status, 64, result.output)
+            XCTAssertTrue(result.output.contains("usage: Insomnia --backstop"), result.output)
+        }
+        XCTAssertNil(BackstopCommand.run(["--resume-frozen", "30"]))
+        XCTAssertEqual(BackstopCommand.run(["--backstop", "x"], bundle: scratch), 64)
+    }
+
+    func testBundleDeclaresTheNativeBackstopInterface() throws {
+        let data = try Data(contentsOf: resources.appendingPathComponent("Info.plist"))
+        let plist = try XCTUnwrap(PropertyListSerialization.propertyList(from: data, format: nil) as? [String: Any])
+        XCTAssertEqual(plist["InsomniaBackstopCommand"] as? String, BackstopCommand.argument)
+        XCTAssertEqual(plist["CFBundleIdentifier"] as? String, Paths.bundleIdentifier)
+    }
+
+    func testNativeSpawnConstraintPinsTheActualExecutableHash() throws {
+        let bundle = try makeSignedBundle()
+        let requirement = try CodeRequirement.designated(ofCodeAt: bundle)
+        let executable = bundle.appendingPathComponent("Contents/MacOS/Insomnia")
+        let target = BackstopTarget(bundle: bundle, requirement: requirement, nativeExecutable: executable)
+        let plist = LaunchdBackstop.plistDictionary(label: "com.insomnia.backstop", target: target)
+        let constraint = try XCTUnwrap(plist["SpawnConstraint"] as? [String: [String: [Data]]])
+        let hashes = try XCTUnwrap(constraint["cdhash"]?["$in"])
+        XCTAssertFalse(hashes.isEmpty)
+        let signature = try run("/usr/bin/codesign", ["-dvvv", executable.path])
+        XCTAssertEqual(signature.status, 0, signature.output)
+        for hash in hashes {
+            XCTAssertTrue(signature.output.contains("CDHash=" + hash.map { String(format: "%02x", $0) }.joined()), signature.output)
+        }
     }
 
     private func run(_ exe: String, _ args: [String], environment: [String: String]? = nil, currentDirectory: URL? = nil) throws -> (status: Int32, output: String) {
@@ -193,14 +256,24 @@ final class PackagingTests: XCTestCase {
     /// The command line the LaunchAgent runs: an intact bundle runs its
     /// sealed backstop.sh; a bundle whose sealed script was edited, or one
     /// that is not the build the plist pins, runs nothing and logs why.
-    func testAgentProgramRunsTheSealedBackstopOnlyWhileTheBundleSatisfiesItsRequirement() throws {
+    func testNativeBackstopRunsTheSealedScriptOnlyWhileTheBundleSatisfiesItsRequirement() throws {
+        try checkAgentRunsTheSealedScriptOnlyWhileTheBundleSatisfiesItsRequirement(.native)
+    }
+
+    /// The same cases through the shell verifier, which launchd still runs
+    /// when the plist cannot use the native command.
+    func testShellVerifierRunsTheSealedScriptOnlyWhileTheBundleSatisfiesItsRequirement() throws {
+        try checkAgentRunsTheSealedScriptOnlyWhileTheBundleSatisfiesItsRequirement(.shell)
+    }
+
+    private func checkAgentRunsTheSealedScriptOnlyWhileTheBundleSatisfiesItsRequirement(_ launcher: AgentLauncher) throws {
         let bundle = try makeSignedBundle()
         let requirement = try CodeRequirement.designated(ofCodeAt: bundle)
         let home = scratch.appendingPathComponent("home", isDirectory: true)
         let ran = home.appendingPathComponent("backstop.ran")
-        let log = home.appendingPathComponent("Library/Logs/Insomnia/insomnia.log")
+        let log = home.appendingPathComponent(launcher.log)
 
-        let intact = try runAgent(requirement: requirement, bundle: bundle, home: home)
+        let intact = try runAgent(launcher, requirement: requirement, bundle: bundle, home: home)
         XCTAssertEqual(intact.status, 0, intact.output)
         XCTAssertEqual(try String(contentsOf: ran, encoding: .utf8), "ran \n", "the sealed script ran, with no arguments")
         XCTAssertFalse(FileManager.default.fileExists(atPath: log.path), "nothing to log while the bundle verifies")
@@ -208,31 +281,54 @@ final class PackagingTests: XCTestCase {
         try FileManager.default.removeItem(at: ran)
         let script = Paths.backstopScript(inBundle: bundle)
         try (String(contentsOf: script, encoding: .utf8) + "echo tampered\n").write(to: script, atomically: true, encoding: .utf8)
-        let edited = try runAgent(requirement: requirement, bundle: bundle, home: home)
+        let edited = try runAgent(launcher, requirement: requirement, bundle: bundle, home: home)
         XCTAssertEqual(edited.status, 1, edited.output)
         XCTAssertFalse(FileManager.default.fileExists(atPath: ran.path), "an edited sealed script must not run")
         var logged = try String(contentsOf: log, encoding: .utf8)
-        XCTAssertTrue(logged.contains("[error] backstop agent: \(bundle.path) does not satisfy the pinned code requirement"), logged)
-        XCTAssertTrue(logged.contains("sealed resource"), "codesign's reason is kept: \(logged)")
+        XCTAssertTrue(logged.contains("\(launcher.refusal)\(bundle.path) does not satisfy the pinned code requirement"), logged)
+        XCTAssertTrue(logged.contains(launcher.editedScriptReason), "the verifier's reason is kept: \(logged)")
         XCTAssertEqual(logged.components(separatedBy: "\n").count, 2, "one line per refusal: \(logged)")
 
         // Another build: a fresh, intact bundle that the pinned requirement
         // (the first bundle's cdhash) does not describe.
         let other = try makeSignedBundle(named: "Other")
         XCTAssertNotEqual(try CodeRequirement.designated(ofCodeAt: other), requirement)
-        let wrongBuild = try runAgent(requirement: requirement, bundle: other, home: home)
+        let wrongBuild = try runAgent(launcher, requirement: requirement, bundle: other, home: home)
         XCTAssertEqual(wrongBuild.status, 1, wrongBuild.output)
         XCTAssertFalse(FileManager.default.fileExists(atPath: ran.path))
         logged = try String(contentsOf: log, encoding: .utf8)
         XCTAssertTrue(logged.contains("\(other.path) does not satisfy"), logged)
-        XCTAssertTrue(logged.contains("failed to satisfy specified code requirement"), logged)
+        XCTAssertTrue(logged.contains(launcher.wrongBuildReason), logged)
 
         // Its own requirement still runs it.
-        let own = try runAgent(requirement: try CodeRequirement.designated(ofCodeAt: other), bundle: other, home: home)
+        let own = try runAgent(launcher, requirement: try CodeRequirement.designated(ofCodeAt: other), bundle: other, home: home)
         XCTAssertEqual(own.status, 0, own.output)
         XCTAssertTrue(FileManager.default.fileExists(atPath: ran.path))
     }
 
+    func testNativeBackstopRejectsAnInvalidRequirementWithoutRunningTheScript() throws {
+        let bundle = try makeSignedBundle()
+        let home = scratch.appendingPathComponent("home", isDirectory: true)
+        let result = try runAgent(requirement: "not a requirement\n", bundle: bundle, home: home)
+        XCTAssertEqual(result.status, 1, result.output)
+        XCTAssertFalse(FileManager.default.fileExists(atPath: home.appendingPathComponent("backstop.ran").path))
+        let logged = try String(contentsOf: home.appendingPathComponent("Logs/insomnia.log"), encoding: .utf8)
+        XCTAssertTrue(logged.contains("the requirement does not parse"), logged)
+        XCTAssertEqual(logged.components(separatedBy: "\n").count, 2, "one line per refusal: \(logged)")
+    }
+
+    func testNativeBackstopPreservesLiteralPathsAndTheScriptExitStatus() throws {
+        let bundle = try makeSignedBundle(named: "Quoted ' & $ bundle")
+        let script = Paths.backstopScript(inBundle: bundle)
+        try (String(contentsOf: script, encoding: .utf8) + "exit 7\n").write(to: script, atomically: true, encoding: .utf8)
+        let signed = try run("/usr/bin/codesign", ["--force", "--sign", "-", bundle.path])
+        XCTAssertEqual(signed.status, 0, signed.output)
+        let home = scratch.appendingPathComponent("home", isDirectory: true)
+        let result = try runAgent(requirement: try CodeRequirement.designated(ofCodeAt: bundle), bundle: bundle, home: home)
+        XCTAssertEqual(result.status, 7, result.output)
+        XCTAssertEqual(try String(contentsOf: home.appendingPathComponent("backstop.ran"), encoding: .utf8), "ran \n")
+    }
+
     // MARK: - What arm() pins (CodeRequirement.pin, real codesign)
 
     /// Reading a requirement does not validate the bundle: a sealed script
diff --git a/Tests/InsomniaTests/RecoveryScriptTests.swift b/Tests/InsomniaTests/RecoveryScriptTests.swift
index 079d5c2d..58e09c61 100644
--- a/Tests/InsomniaTests/RecoveryScriptTests.swift
+++ b/Tests/InsomniaTests/RecoveryScriptTests.swift
@@ -4429,7 +4429,7 @@ final class RecoveryScriptTests: XCTestCase {
         XCTAssertEqual(plist["StartInterval"] as? Int, 60)
         // The plist must be exactly what the app builds for the same bundle
         // and requirement, or the app reloads the agent at every start.
-        let expected = LaunchdBackstop.plistDictionary(label: "com.insomnia.backstop", target: BackstopTarget(bundle: fx.app, requirement: fx.requirement))
+        let expected = LaunchdBackstop.plistDictionary(label: "com.insomnia.backstop", target: BackstopTarget(bundle: fx.app, requirement: fx.requirement, nativeExecutable: fx.app.appendingPathComponent("Contents/MacOS/Insomnia")))
         XCTAssertTrue(NSDictionary(dictionary: plist).isEqual(to: expected), "install.sh wrote \(plist), the app builds \(expected)")
         XCTAssertTrue(calls.contains { $0.hasPrefix("codesign --verify --strict -R=\(fx.requirement) \(fx.appsDir.path)/.Insomnia.app.staging.") && $0.hasSuffix("/Insomnia.app") }, "the installer runs the agent's own check once, on the staged bundle: \(calls)")
         XCTAssertEqual(try fx.installedBinaryFirstLine(), "#!/bin/bash", "the new bundle is installed")
@@ -4499,11 +4499,43 @@ final class RecoveryScriptTests: XCTestCase {
         XCTAssertTrue(fx.exists(fx.installedBackstop))
         XCTAssertTrue(fx.exists(prebuilt), "the source bundle is copied, not moved")
         let plist = try fx.plistOnDisk()
-        let expected = LaunchdBackstop.plistDictionary(label: "com.insomnia.backstop", target: BackstopTarget(bundle: fx.app, requirement: fx.requirement))
+        let expected = LaunchdBackstop.plistDictionary(label: "com.insomnia.backstop", target: BackstopTarget(bundle: fx.app, requirement: fx.requirement, nativeExecutable: fx.app.appendingPathComponent("Contents/MacOS/Insomnia")))
         XCTAssertTrue(NSDictionary(dictionary: plist).isEqual(to: expected), "same agent as a source install: \(plist)")
         XCTAssertTrue(r.stdout.contains("Uninstall:"), r.stdout)
     }
 
+    func testInstallKeepsTheShellLauncherForABundleWithoutTheBackstopMode() throws {
+        try fx.prepareInstall()
+        let prebuilt = try fx.writePrebuiltApp()
+        let info = prebuilt.appendingPathComponent("Contents/Info.plist")
+        let text = try String(contentsOf: info, encoding: .utf8)
+        try text.replacingOccurrences(of: "<key>InsomniaBackstopCommand</key><string>--backstop</string>", with: "")
+            .write(to: info, atomically: true, encoding: .utf8)
+        fx.setMode("launchctl", "loaded")
+
+        let result = try fx.run(fx.installRedirected, ["--allow-unverified-origin", "--app", prebuilt.path], extraEnvironment: ["USER": "tester"])
+
+        XCTAssertEqual(result.status, 0, result.stderr + result.stdout)
+        let plist = try fx.plistOnDisk()
+        XCTAssertEqual(plist["ProgramArguments"] as? [String], ["/bin/sh", "-c", LaunchdBackstop.agentProgram, "sh", fx.requirement, fx.app.path])
+        XCTAssertNil(plist["AssociatedBundleIdentifiers"], "a system shell cannot be attributed to our signer")
+    }
+
+    func testInstallKeepsTheExternalVerifierUnlessSIPIsKnownEnabled() throws {
+        try fx.prepareInstall()
+        let prebuilt = try fx.writePrebuiltApp()
+        fx.setMode("launchctl", "loaded")
+        for mode in ["disabled", "unknown", "fail"] {
+            fx.setMode("csrutil", mode)
+            let result = try fx.run(fx.installRedirected, ["--allow-unverified-origin", "--app", prebuilt.path], extraEnvironment: ["USER": "tester"])
+            XCTAssertEqual(result.status, 0, result.stderr + result.stdout)
+            let plist = try fx.plistOnDisk()
+            XCTAssertEqual(plist["ProgramArguments"] as? [String], ["/bin/sh", "-c", LaunchdBackstop.agentProgram, "sh", fx.requirement, fx.app.path])
+            XCTAssertNil(plist["SpawnConstraint"])
+            XCTAssertNil(plist["AssociatedBundleIdentifiers"])
+        }
+    }
+
     /// The checks run on a private copy, and that copy is what gets staged
     /// and pinned. A bundle swapped at the --app path while the password
     /// prompt waits (the fake sudo does it during visudo) is never copied in.
@@ -4686,7 +4718,7 @@ final class RecoveryScriptTests: XCTestCase {
         XCTAssertEqual(installed.status, 0, "the ditto copy at the installed path verifies: \(installed.output)")
         XCTAssertNoThrow(try CodeRequirement.verify(codeAt: fx.app, satisfies: requirement))
         let plist = try fx.plistOnDisk()
-        let expected = LaunchdBackstop.plistDictionary(label: "com.insomnia.backstop", target: BackstopTarget(bundle: fx.app, requirement: requirement))
+        let expected = LaunchdBackstop.plistDictionary(label: "com.insomnia.backstop", target: BackstopTarget(bundle: fx.app, requirement: requirement, nativeExecutable: fx.app.appendingPathComponent("Contents/MacOS/Insomnia")))
         XCTAssertTrue(NSDictionary(dictionary: plist).isEqual(to: expected), "the agent pins the real requirement: \(plist)")
         XCTAssertTrue(fx.calls().contains { $0.hasPrefix("launchctl bootstrap") }, "\(fx.calls())")
 
@@ -5004,6 +5036,24 @@ final class RecoveryScriptTests: XCTestCase {
         XCTAssertTrue(pinsCurrent.stdout.contains("removed the bundle an interrupted run had set aside"), pinsCurrent.stdout)
     }
 
+    func testInstallRepairsAnInterruptedSwapUsingTheLegacyShellPlist() throws {
+        try fx.prepareInstall()
+        let previous = fx.appsDir.appendingPathComponent(".Insomnia.app.previous", isDirectory: true)
+        try fx.writeBundle(at: previous, marker: "previous")
+        try fx.writeBundle(at: fx.app, marker: "interrupted")
+        let plist: [String: Any] = [
+            "Label": "com.insomnia.backstop",
+            "ProgramArguments": ["/bin/sh", "-c", LaunchdBackstop.agentProgram, "sh", fx.requirement, fx.app.path],
+            "RunAtLoad": true, "StartInterval": 60,
+        ]
+        try PropertyListSerialization.data(fromPropertyList: plist, format: .xml, options: 0).write(to: fx.plist)
+        try fx.rejectSignature(of: fx.app)
+        let result = try fx.run(fx.installRedirected, extraEnvironment: ["USER": "tester"])
+        XCTAssertEqual(result.status, 1, result.stderr + result.stdout)
+        XCTAssertEqual(try fx.installedBinaryFirstLine(), "previous")
+        XCTAssertTrue(fx.calls().contains("codesign --verify --strict -R=\(fx.requirement) \(previous.path)"))
+    }
+
     /// The interrupted run may have left its own job loaded (killed after
     /// its bootstrap, or its unload failed), and that job pins the build at
     /// $APP. The rerun first ends the stale session (its recovery step), and
@@ -6711,7 +6761,9 @@ private final class ScriptFixture {
         try """
         <?xml version="1.0" encoding="UTF-8"?>
         <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-        <plist version="1.0"><dict><key>CFBundleIdentifier</key><string>com.kgarg.insomnia</string></dict></plist>
+        <plist version="1.0"><dict><key>CFBundleIdentifier</key><string>com.kgarg.insomnia</string>
+        <key>CFBundleExecutable</key><string>Insomnia</string>
+        <key>InsomniaBackstopCommand</key><string>--backstop</string></dict></plist>
         """.write(to: resources.appendingPathComponent("Info.plist"), atomically: true, encoding: .utf8)
         try "icns".write(to: resources.appendingPathComponent("AppIcon.icns"), atomically: true, encoding: .utf8)
         let binroot = root.appendingPathComponent("binroot", isDirectory: true)
@@ -6832,6 +6884,7 @@ private final class ScriptFixture {
             "LAUNCHCTL": bin.appendingPathComponent("launchctl").path,
             "SUDO": bin.appendingPathComponent("sudo").path,
             "CODESIGN": bin.appendingPathComponent("codesign").path,
+            "CSRUTIL": bin.appendingPathComponent("csrutil").path,
             "SYSCTL": bin.appendingPathComponent("sysctl").path,
             "MV": bin.appendingPathComponent("mv").path,
             "RM": bin.appendingPathComponent("rm").path,
@@ -6868,6 +6921,7 @@ private final class ScriptFixture {
         <key>CFBundleIdentifier</key><string>\(bundleID)</string>
         <key>CFBundlePackageType</key><string>APPL</string>
         <key>CFBundleShortVersionString</key><string>\(version)</string>
+        <key>InsomniaBackstopCommand</key><string>--backstop</string>
         </dict></plist>
         """.write(to: app.appendingPathComponent("Contents/Info.plist"), atomically: true, encoding: .utf8)
         if machO {
@@ -7087,6 +7141,14 @@ private final class ScriptFixture {
             exec \(real) "$@"
             """)
         }
+        try writeFake("csrutil", """
+        mode="$(cat "\(r)/csrutil.mode" 2>/dev/null || echo enabled)"
+        case "$mode" in
+          fail) echo 'System Integrity Protection status: enabled.'; exit 1 ;;
+          unknown) echo 'System Integrity Protection status: unknown (Custom Configuration).' ;;
+          *) echo "System Integrity Protection status: $mode." ;;
+        esac
+        """)
         // codesign: signing is recorded and succeeds. `-d -r-` prints a
         // fixed designated requirement the way codesign does (on stderr,
         // with the "# " an implicit requirement carries). `-dvv` describes
@@ -7482,7 +7544,7 @@ private final class ScriptFixture {
     /// The agent plist an install writes for the bundle at $APP, pinning
     /// the fake codesign's requirement.
     func writeAgentPlist() throws {
-        let dict = LaunchdBackstop.plistDictionary(label: "com.insomnia.backstop", target: BackstopTarget(bundle: app, requirement: requirement))
+        let dict = LaunchdBackstop.plistDictionary(label: "com.insomnia.backstop", target: BackstopTarget(bundle: app, requirement: requirement, nativeExecutable: app.appendingPathComponent("Contents/MacOS/Insomnia")))
         let data = try PropertyListSerialization.data(fromPropertyList: dict, format: .xml, options: 0)
         try data.write(to: plist)
     }
diff --git a/docs/install.md b/docs/install.md
index 90248d12..e87d2b81 100644
--- a/docs/install.md
+++ b/docs/install.md
@@ -188,10 +188,25 @@ login Keychain, not the configuration file.
 
 The recovery agent runs at login and every 60 seconds. Its command line pins
 the installed bundle's code requirement (for an ad-hoc build, the cdhash of
-that build) and runs `codesign --verify --strict` against it before executing
-the `backstop.sh` sealed inside the bundle. An edited bundle or script fails
-that check: the agent writes one line to `insomnia.log` and runs nothing until
-you reinstall. So no other account can edit it, the installer removes group
+that build) and verifies its signature and resources before executing the
+`backstop.sh` sealed inside the bundle. The native command uses the Security
+framework and directly executes `/bin/bash` with that script path; the external
+fallback runs `codesign --verify --strict`. Current ad-hoc builds start the
+app's headless recovery command, with a `SpawnConstraint` that launchd checks
+against the pinned cdhashes before the binary executes. Restoring an old
+binary or replacing it with one that skips verification is rejected by
+launchd, with a code-signing diagnostic in the system log. This enforcement
+requires System Integrity Protection to be enabled. The installer and each
+session's `arm()` check `csrutil status`; disabled, custom or unavailable
+status selects the external shell verifier instead. That agent runs
+`/bin/sh`, so Login Items & Extensions lists it as `sh` with a generic icon,
+not as Insomnia. After changing SIP,
+open the app and start a session or reinstall to replace a previously
+registered native agent. An edited sealed script
+is refused by the subsequent full-bundle check and logged in `insomnia.log`.
+Older bundles and other code-requirement formats keep the external shell
+verifier. Reinstall to restore the matching bundle/agent pair.
+So no other account can edit it, the installer removes group
 and other write permission and every ACL from the bundle it installs. The
 signature covers neither, so the bundle still verifies, and extended
 attributes such as a download's quarantine flag are kept. No executable is
diff --git a/docs/releasing.md b/docs/releasing.md
index d896e7cf..1a5f554f 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -224,6 +224,11 @@ below cover what only a real Mac shows.
 
 - With a text field focused in another app, open the duration pills and type digits, Tab, Backspace and Esc: only Insomnia changes, and Esc returns focus to the previous app. Repeat for extending a session and after a refused start. Switching apps closes the pills without taking focus back. Clicking an already-open Settings window keeps keyboard focus in Settings; opening Settings/Quit closes the pills and gives the menu its own keyboard input. Repeat on another display/Space. Do not send Enter to a chat or terminal as a test.
 
+- With SIP enabled, Login Items & Extensions lists the recovery agent as Insomnia with its app icon after an upgrade from the shell-based agent and after login; `launchctl print gui/$(id -u)/com.insomnia.backstop` starts `Insomnia --backstop` and records exit code 0 without opening the menu bar app. Ad-hoc builds may still say "Item from unidentified developer". Do not reset the background task database to clear a cached shell entry. With SIP disabled the agent is the shell verifier, and the row reads `sh` with a generic icon.
+- With SIP enabled, test the native plist's `SpawnConstraint` on a disposable agent: the pinned ad-hoc executable runs, but a different ad-hoc executable that only writes a marker (and performs no verification) must leave no marker and report `OS_REASON_CODESIGNING`. The same replacement without the constraint must run as a control. Restore an older Insomnia binary under the native plist and confirm that no GUI starts. Keep the full-bundle verification tests for edited scripts too.
+- Capture the native agent's `launchctl print` output, including `properties`, before and after a second `arm()` on the same build. Confirm the second call does not bootout/bootstrap the job, reset its run count or post another background-item notification. Preserve the raw output in the head's validation report; unit-test captures from disposable jobs do not replace the installed-agent check.
+- On a separately approved test machine already configured with SIP disabled, confirm installation and a later session use the external shell verifier. A registered native job must be replaced on the next `arm()` after a SIP change. Do not change a contributor's SIP settings for an automated test; unknown and failed status reads are also covered by injected tests.
+- Measure idle recovery launch cost against the external shell with the same temporary clean journal; record warm-run timings, since the native entry point loads the app's linked frameworks every minute.
 - Normal end, deadline expiry, and repeated Quit restore live power state
 - `Insomnia --session start 120` from Terminal while the app runs: the menu bar counts the session down and `pmset -g` reads SleepDisabled 1, `--session extend 60` moves the countdown out, and hold-to-end and `--session end` each end the session with SleepDisabled 0; with the app quit, the command prints that Insomnia is not running, and the next launch starts nothing
 - Sleep guard read back: on a Mac where another process sets SleepDisabled back to 0 about 2 s after `pmset -a disablesleep 1` (for example a root LaunchDaemon that loops `pmset -a disablesleep 0`), Start fails after about 5 s with "SleepDisabled read 0 again" and no session runs; on a Mac where the bit holds, the session starts about 5 s after Start and `pmset -g` reads SleepDisabled 1
@@ -336,7 +341,7 @@ below cover what only a real Mac shows.
 
 - Install/upgrade/uninstall with recoverable failure conditions
 - Settings > General shows the version from the installed bundle's Info.plist, and the launch line in insomnia.log carries the same; "Check for updates" names the newest stable and nightly tags as the releases page shows them and says whether the installed version is behind, and with Wi-Fi off it shows "Could not check" with the reason, the log has the failure line, and nothing else changes
-- Recovery agent refuses to run after the installed bundle or its sealed backstop.sh is modified, and logs why
+- Recovery agent refuses to run after the installed bundle or its sealed backstop.sh is modified, and logs why. For the native command, confirm the strict in-process verification refuses the edited resource before `/bin/bash` starts; restore the matching signed bundle before continuing.
 - Running app refuses to arm (session start refused, reason shown) after its installed bundle is edited or re-signed under it
 - Upgrade whose new agent fails to load puts the previous bundle back and reloads the previous agent, on a working Mac
 - Upgrade whose new agent plist cannot be saved, and a rerun after an install killed mid-swap, leave the app and the agent's plist matching, on a working Mac
diff --git a/docs/spec.md b/docs/spec.md
index 3045cf6d..882bcf6a 100644
--- a/docs/spec.md
+++ b/docs/spec.md
@@ -59,6 +59,21 @@ closed bag. Its design goals are to:
 
 ## Core model
 
+The recovery agent starts the app's headless `--backstop` command only when
+the bundle advertises that command in `InsomniaBackstopCommand` and its
+pinned requirement consists entirely of cdhash clauses, and a bounded
+`csrutil status` call reports SIP enabled. `SpawnConstraint`
+lets launchd enforce those hashes before any app code executes; the command
+then runs the existing full-bundle verifier before the sealed script. Both
+the installer and `arm()` use the external shell verifier for older bundles
+or other requirement formats, or disabled, custom or unreadable SIP status,
+including a `swift run` build targeting an
+older installed app. The executable name comes from `CFBundleExecutable`.
+The native bundle path gives Background Task Management the app identity;
+`AssociatedBundleIdentifiers` also names the app, but is not proof of
+attribution for ad-hoc signatures with no Team ID. Appearance still needs
+the real-Mac check, and no Developer ID identity is implied.
+
 ```
 Session {
   startedAt:   Date
@@ -878,8 +893,10 @@ Backstop, independent of the app:
   journal, any `session.json` and `--force` take the full run.
 - The agent runs only the `backstop.sh` sealed in the signed bundle. Its
   command line verifies the bundle against the code requirement pinned in the
-  plist (`codesign --verify --strict -R=...`; for an ad-hoc build, that
-  build's cdhash) and execs the script when that passes; otherwise it logs
+  plist (strict Security framework validation in the native command, or
+  `codesign --verify --strict -R=...` in the external fallback; for an ad-hoc
+  build, that build's cdhash) and directly execs `/bin/bash` with the sealed
+  script path when that passes; otherwise it logs
   one line and exits without running anything. No executable lives in a
   writable directory. The plist is a per-user file like any LaunchAgent; at
   the next arm the app rewrites a plist that does not match, and reloads a
diff --git a/scripts/install.sh b/scripts/install.sh
index 3806eb38..b08c5f67 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -55,6 +55,8 @@ LAUNCHCTL=/bin/launchctl
 SUDO=/usr/bin/sudo
 PLUTIL=/usr/bin/plutil
 CODESIGN=/usr/bin/codesign
+CSRUTIL=/usr/bin/csrutil
+BASE64=/usr/bin/base64
 DITTO=/usr/bin/ditto
 CHMOD=/bin/chmod
 SYSCTL=/usr/sbin/sysctl
@@ -676,7 +678,11 @@ done
 # it is not known which of the two it pins.
 plist_pins_previous() {
   local pinned rc
-  pinned="$("$PLUTIL" -extract ProgramArguments.4 raw -o - "$PLIST" 2>/dev/null || true)"
+  if [[ "$("$PLUTIL" -extract ProgramArguments.1 raw -o - "$PLIST" 2>/dev/null || true)" == --backstop ]]; then
+    pinned="$("$PLUTIL" -extract ProgramArguments.2 raw -o - "$PLIST" 2>/dev/null || true)"
+  else
+    pinned="$("$PLUTIL" -extract ProgramArguments.4 raw -o - "$PLIST" 2>/dev/null || true)"
+  fi
   [[ -n "$pinned" ]] || return 1
   rc=0
   bounded "$CODESIGN" --verify --strict "-R=$pinned" "$APP" || rc=$?
@@ -883,7 +889,9 @@ fi
 # 6. LaunchAgent: verifies the bundle and runs its sealed backstop at load
 #    and every 60 s. The backstop enforces the saved deadline itself and is
 #    a no-op while the session on disk is valid. The plist's ProgramArguments
-#    are `/bin/sh -c "$AGENT_PROGRAM" sh "$REQUIREMENT" "$APP"`: the program
+#    start `Insomnia --backstop "$REQUIREMENT"` without the UI, so Login
+#    Items associates the agent with the app instead of a system shell.
+#    Older bundles without that mode keep the shell launcher. The program
 #    runs `codesign --verify --strict -R=<requirement>` on the bundle and
 #    execs Contents/Resources/backstop.sh only when that passes; otherwise it
 #    logs one line to $LOG_DIR/insomnia.log and exits 1 without running
@@ -912,6 +920,34 @@ before="$(loaded_state)"
 
 # shellcheck disable=SC2016  # the $1/$2/$HOME/$r below are for the agent's shell, not this one
 AGENT_PROGRAM='r="$(/usr/bin/codesign --verify --strict "-R=$1" "$2" 2>&1)" && exec /bin/bash "$2/Contents/Resources/backstop.sh"; mkdir -p "$HOME/Library/Logs/Insomnia"; printf "%s [error] backstop agent: %s does not satisfy the pinned code requirement; backstop.sh not run. Reinstall Insomnia (scripts/install.sh). codesign: %s\n" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$2" "$(printf %s "$r" | tr "\n" " ")" >> "$HOME/Library/Logs/Insomnia/insomnia.log"; exit 1'
+AGENT_ARGUMENTS=(/bin/sh -c "$AGENT_PROGRAM" sh "$REQUIREMENT" "$APP")
+# Only complete cdhash requirements can become a pre-execution constraint.
+# Unknown clauses keep the external verifier, as in LaunchdBackstop.swift.
+launch_hashes() {
+  local rest="$REQUIREMENT" clause hash encoded i
+  while :; do
+    clause="${rest%% or *}"
+    [[ "$clause" =~ ^cdhash\ H\"([[:xdigit:]]{40})\"$ ]] || return 1
+    hash="${BASH_REMATCH[1]}"
+    encoded="$(for (( i = 0; i < 40; i += 2 )); do printf '%b' "\\x${hash:i:2}"; done | "$BASE64")" || return 1
+    [[ -n "$encoded" ]] || return 1
+    printf '\t\t\t<data>%s</data>\n' "$encoded"
+    [[ "$rest" == *" or "* ]] || break
+    rest="${rest#* or }"
+  done
+}
+LAUNCH_HASHES="$(launch_hashes)" || LAUNCH_HASHES=""
+NATIVE_BACKSTOP="$("$PLUTIL" -extract InsomniaBackstopCommand raw -o - "$NEW_APP/Contents/Info.plist" 2>/dev/null || true)"
+EXECUTABLE_NAME="$("$PLUTIL" -extract CFBundleExecutable raw -o - "$NEW_APP/Contents/Info.plist" 2>/dev/null || true)"
+AGENT_EXECUTABLE=""
+case "$EXECUTABLE_NAME" in
+  ""|.|..|*/*) ;;
+  *) if [[ "$NATIVE_BACKSTOP" == --backstop && -n "$LAUNCH_HASHES" ]] &&
+        bounded "$CSRUTIL" status && [[ "$BOUNDED_OUTPUT" == 'System Integrity Protection status: enabled.' ]]; then
+       AGENT_EXECUTABLE="$APP/Contents/MacOS/$EXECUTABLE_NAME"
+       AGENT_ARGUMENTS=("$AGENT_EXECUTABLE" --backstop "$REQUIREMENT")
+     fi ;;
+esac
 xml_escape() { sed -e 's/&/\&amp;/g' -e 's/</\&lt;/g' -e 's/>/\&gt;/g'; }
 cat > "$CANDIDATE" <<PLIST
 <?xml version="1.0" encoding="UTF-8"?>
@@ -920,14 +956,15 @@ cat > "$CANDIDATE" <<PLIST
 <dict>
 	<key>Label</key>
 	<string>$LABEL</string>
+$(if [[ -n "$AGENT_EXECUTABLE" ]]; then
+  printf '\t<key>AssociatedBundleIdentifiers</key>\n\t<array><string>%s</string></array>\n' "$BUNDLE_ID"
+  printf '\t<key>SpawnConstraint</key>\n\t<dict><key>cdhash</key><dict><key>%s</key><array>\n%s\n\t</array></dict></dict>\n' "\$in" "$LAUNCH_HASHES"
+fi)
 	<key>ProgramArguments</key>
 	<array>
-		<string>/bin/sh</string>
-		<string>-c</string>
-		<string>$(printf '%s' "$AGENT_PROGRAM" | xml_escape)</string>
-		<string>sh</string>
-		<string>$(printf '%s' "$REQUIREMENT" | xml_escape)</string>
-		<string>$(printf '%s' "$APP" | xml_escape)</string>
+$(for argument in "${AGENT_ARGUMENTS[@]}"; do
+  printf '\t\t<string>%s</string>\n' "$(printf '%s' "$argument" | xml_escape)"
+done)
 	</array>
 	<key>RunAtLoad</key>
 	<true/>