diff --git a/scripts/otter/fixtures/macos-profile.plist b/scripts/otter/fixtures/macos-profile.plist
index ab4e2ce4510d..3fa8fe146790 100644
--- a/scripts/otter/fixtures/macos-profile.plist
+++ b/scripts/otter/fixtures/macos-profile.plist
@@ -1,4 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
+<!-- Shaped like the Developer ID (Mac) profile Apple issued on 2026-10-12. -->
 <plist version="1.0">
   <dict>
     <key>Entitlements</key>
@@ -10,11 +11,11 @@
       <key>keychain-access-groups</key>
       <array><string>YNJ5WLH965.*</string></array>
       <key>com.apple.developer.associated-domains</key>
-      <array><string>*</string></array>
-      <key>aps-environment</key>
+      <string>*</string>
+      <key>com.apple.developer.aps-environment</key>
       <string>production</string>
       <key>com.apple.security.application-groups</key>
-      <array><string>group.dev.otterware.code</string></array>
+      <array><string>group.dev.otterware.code</string><string>YNJ5WLH965.*</string></array>
     </dict>
   </dict>
 </plist>
diff --git a/scripts/otter/macos-profile.ts b/scripts/otter/macos-profile.ts
index 9a2979f7ff53..ac719ddbd2cf 100644
--- a/scripts/otter/macos-profile.ts
+++ b/scripts/otter/macos-profile.ts
@@ -139,7 +139,10 @@ const ProvisioningProfilePlist = Schema.Struct({
   Entitlements: Schema.Struct({
     "com.apple.application-identifier": Schema.optional(Schema.String),
     "com.apple.developer.team-identifier": Schema.optional(Schema.String),
-    "com.apple.developer.associated-domains": Schema.optional(Schema.Array(Schema.String)),
+    // Developer ID profiles grant a wildcard as the bare string "*", not a list.
+    "com.apple.developer.associated-domains": Schema.optional(
+      Schema.Union([Schema.String, Schema.Array(Schema.String)]),
+    ),
     "keychain-access-groups": Schema.optional(Schema.Array(Schema.String)),
     [BROWSER_PASSKEYS_ENTITLEMENT]: Schema.optional(Schema.Boolean),
   }),
@@ -200,13 +203,15 @@ export function renderMacPasskeyEntitlements(
       : "";
   const associatedDomains = configuration.rpDomains
     .filter((domain) =>
-      (grants?.["com.apple.developer.associated-domains"] ?? []).some(
-        (grant) =>
-          grant === "*" ||
-          grant === `webcredentials:${domain}` ||
-          (grant.startsWith("webcredentials:*.") &&
-            domain.endsWith(grant.slice("webcredentials:*".length))),
-      ),
+      [grants?.["com.apple.developer.associated-domains"] ?? []]
+        .flat()
+        .some(
+          (grant) =>
+            grant === "*" ||
+            grant === `webcredentials:${domain}` ||
+            (grant.startsWith("webcredentials:*.") &&
+              domain.endsWith(grant.slice("webcredentials:*".length))),
+        ),
     )
     .map((domain) => `      <string>webcredentials:${escapeXml(domain)}</string>`)
     .join("\n");