diff --git a/BusyMirror.xcodeproj/project.pbxproj b/BusyMirror.xcodeproj/project.pbxproj
index 9ffbf8b..297080c 100644
--- a/BusyMirror.xcodeproj/project.pbxproj
+++ b/BusyMirror.xcodeproj/project.pbxproj
@@ -410,7 +410,7 @@
 				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "-";
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 15;
+				CURRENT_PROJECT_VERSION = 16;
 				ENABLE_PREVIEWS = YES;
 				GENERATE_INFOPLIST_FILE = YES;
 				INFOPLIST_FILE = BusyMirror/Info.plist;
@@ -421,7 +421,7 @@
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-                MARKETING_VERSION = 1.3.7;
+                MARKETING_VERSION = 1.3.8;
 				PRODUCT_BUNDLE_IDENTIFIER = com.cqrenet.BusyMirror;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				REGISTER_APP_GROUPS = YES;
@@ -440,7 +440,7 @@
 				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "-";
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 15;
+				CURRENT_PROJECT_VERSION = 16;
 				ENABLE_PREVIEWS = YES;
 				GENERATE_INFOPLIST_FILE = YES;
 				INFOPLIST_FILE = BusyMirror/Info.plist;
@@ -451,7 +451,7 @@
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-                MARKETING_VERSION = 1.3.7;
+                MARKETING_VERSION = 1.3.8;
 				PRODUCT_BUNDLE_IDENTIFIER = com.cqrenet.BusyMirror;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				REGISTER_APP_GROUPS = YES;
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f0c8a17..d39ede4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,12 @@
 
 All notable changes to BusyMirror will be documented in this file.
 
+## [1.3.8] - 2026-04-08
+- Fix: release ZIPs now package `BusyMirror.app` at the archive root instead of embedding the full build path.
+- Fix: release builds now apply an ad-hoc bundle signature before packaging so downloaded artifacts pass `codesign --verify --deep --strict`.
+- Build: suppress resource fork sidecars in release ZIPs via `ditto --norsrc --keepParent`.
+- Build: bump version to 1.3.8 (build 16).
+
 ## [1.3.7] - 2026-03-24
 - Fix: mirror reconciliation now survives target providers that strip BusyMirror's custom event URL metadata.
 - Fix: moved and deleted source events are tracked via stable EventKit identifiers and a persisted local mirror index, so target placeholders update reliably.
diff --git a/Makefile b/Makefile
index a642c16..be1fb06 100644
--- a/Makefile
+++ b/Makefile
@@ -8,7 +8,7 @@ DEST := platform=macOS
 # Extract marketing version from project settings
 VERSION := $(shell sed -n 's/.*MARKETING_VERSION = \([0-9.]*\);.*/\1/p' $(PROJECT)/project.pbxproj | head -n1)
 
-.PHONY: all clean build-debug build-release open app package
+.PHONY: all clean build-debug build-release sign-app open app package
 
 all: build-release
 
@@ -31,16 +31,25 @@ open: app
 
 # Path to built app (Release)
 APP_PATH := $(DERIVED)/Build/Products/Release/BusyMirror.app
+SIGNED_APP_PATH := build/ReleaseSigned/BusyMirror.app
 
-app: build-release
+sign-app: build-release
+	@echo "Preparing signed release app…"
+	@rm -rf "$(SIGNED_APP_PATH)"
+	@mkdir -p "$(dir $(SIGNED_APP_PATH))"
+	@ditto "$(APP_PATH)" "$(SIGNED_APP_PATH)"
+	@xattr -rc "$(SIGNED_APP_PATH)"
+	@codesign --force --deep --sign - "$(SIGNED_APP_PATH)"
+	@codesign --verify --deep --strict --verbose=2 "$(SIGNED_APP_PATH)"
+
+app: sign-app
 	@# Ensure the app exists
-	@test -d "$(APP_PATH)" && echo "Built: $(APP_PATH)" || (echo "App not found at $(APP_PATH)" && exit 1)
+	@test -d "$(SIGNED_APP_PATH)" && echo "Built: $(SIGNED_APP_PATH)" || (echo "App not found at $(SIGNED_APP_PATH)" && exit 1)
 	@echo "Version: $(VERSION)"
 	@echo "OK"
 
 package: app
 	@echo "Packaging BusyMirror $(VERSION)…"
-	@zip -qry "BusyMirror-$(VERSION)-macOS.zip" "$(APP_PATH)"
+	@ditto --norsrc -c -k --keepParent "$(SIGNED_APP_PATH)" "BusyMirror-$(VERSION)-macOS.zip"
 	@shasum -a 256 "BusyMirror-$(VERSION)-macOS.zip" | awk '{print $$1}' > "BusyMirror-$(VERSION)-macOS.zip.sha256"
 	@echo "Created BusyMirror-$(VERSION)-macOS.zip and .sha256"
-
diff --git a/ReleaseNotes-1.3.8.md b/ReleaseNotes-1.3.8.md
new file mode 100644
index 0000000..199efa2
--- /dev/null
+++ b/ReleaseNotes-1.3.8.md
@@ -0,0 +1,9 @@
+BusyMirror 1.3.8 - 2026-04-08
+
+Changes
+- Fix release packaging so the ZIP contains `BusyMirror.app` at the archive root.
+- Apply an ad-hoc bundle signature before packaging so the distributed app bundle verifies correctly after unzip.
+- Strip resource fork sidecars from release archives to avoid malformed download contents.
+
+Build
+- Version bump to 1.3.8 (build 16).