diff --git a/.gitea/workflows/build-macos.yml b/.gitea/workflows/build-macos.yml
index 23899a1..1515a0e 100644
--- a/.gitea/workflows/build-macos.yml
+++ b/.gitea/workflows/build-macos.yml
@@ -135,11 +135,18 @@ jobs:
           ./Scripts/package_release.sh "${{ matrix.platform.arch }}" "${PREFIX}"
           (cd build/release-assets && shasum -a 256 "${PREFIX}.app.zip" "${PREFIX}.dmg" | tee "${PREFIX}.SHA256.txt")
 
+      - name: Archive ${{ matrix.platform.arch }} .app (for universal lipo)
+        working-directory: ${{ env.PROJECT_ROOT }}
+        run: |
+          ditto -c -k --keepParent \
+            "build/apps/${{ matrix.platform.arch }}/TargetPrint.app" \
+            "build/apps/${{ matrix.platform.arch }}/TargetPrint.app.zip"
+
       - name: Upload ${{ matrix.platform.arch }} .app (for universal lipo)
         uses: actions/upload-artifact@v3
         with:
           name: app-${{ matrix.platform.arch }}
-          path: ${{ env.PROJECT_ROOT }}/build/apps/${{ matrix.platform.arch }}/TargetPrint.app
+          path: ${{ env.PROJECT_ROOT }}/build/apps/${{ matrix.platform.arch }}/TargetPrint.app.zip
 
       - name: Upload ${{ matrix.platform.arch }} packages
         uses: actions/upload-artifact@v3
@@ -148,7 +155,7 @@ jobs:
           path: ${{ env.PROJECT_ROOT }}/build/release-assets/${{ env.PREFIX }}.*
 
       - name: Upload Release Assets to Gitea
-        if: ${{ startsWith(github.ref, 'refs/tags/') && !cancelled() }}
+        if: ${{ startsWith(github.ref, 'refs/tags/') && success() }}
         env:
           GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SERVER_URL: ${{ github.server_url }}
@@ -241,20 +248,46 @@ jobs:
           MACOS_CODESIGN_IDENTITY: ${{ secrets.MACOS_CODESIGN_IDENTITY }}
         run: |
           export MACOS_CODESIGN_IDENTITY="${MACOS_CODESIGN_IDENTITY:--}"
-          # upload-artifact may nest as TargetPrint.app/ or as Contents/ at the root
           for arch in x86_64 arm64; do
             base="build/apps/${arch}"
-            if [ ! -x "${base}/TargetPrint.app/Contents/MacOS/TargetPrint" ] \
-               && [ -x "${base}/Contents/MacOS/TargetPrint" ]; then
+            echo "==> Preparing ${arch} in ${base}"
+
+            # 1. If downloaded as zip (from ditto -c -k), unpack it cleanly
+            ZIP_FILE="$(find "${base}" -maxdepth 2 -name "*.zip" 2>/dev/null | head -n 1 || true)"
+            if [ -n "${ZIP_FILE}" ] && [ -f "${ZIP_FILE}" ]; then
+              echo "Extracting bundle archive: ${ZIP_FILE}"
+              ditto -x -k "${ZIP_FILE}" "${base}"
+              rm -f "${ZIP_FILE}"
+            fi
+
+            # 2. If uncompressed bundle contents were downloaded without TargetPrint.app folder
+            if [ ! -d "${base}/TargetPrint.app" ] && [ -d "${base}/Contents" ]; then
+              echo "Reconstructing TargetPrint.app from root Contents/ in ${base}..."
               mkdir -p "${base}/TargetPrint.app"
-              # Move bundle contents into TargetPrint.app
               shopt -s dotglob
               mv "${base}/Contents" "${base}/PkgInfo" "${base}/Resources" "${base}/Info.plist" \
                  "${base}/_CodeSignature" "${base}/TargetPrint.app/" 2>/dev/null || true
               shopt -u dotglob
             fi
-            test -x "${base}/TargetPrint.app/Contents/MacOS/TargetPrint"
-            lipo -info "${base}/TargetPrint.app/Contents/MacOS/TargetPrint"
+
+            # 3. If nested inside a subfolder (e.g. app-x86_64/TargetPrint.app)
+            NESTED_APP="$(find "${base}" -mindepth 2 -maxdepth 3 -name "TargetPrint.app" -type d 2>/dev/null | head -n 1 || true)"
+            if [ -n "${NESTED_APP}" ] && [ "${NESTED_APP}" != "${base}/TargetPrint.app" ]; then
+              echo "Moving nested app from ${NESTED_APP} to ${base}/TargetPrint.app..."
+              rm -rf "${base}/TargetPrint.app"
+              mv "${NESTED_APP}" "${base}/TargetPrint.app"
+            fi
+
+            BIN="${base}/TargetPrint.app/Contents/MacOS/TargetPrint"
+            if [ ! -f "${BIN}" ]; then
+              echo "ERROR: Missing binary at ${BIN}" >&2
+              ls -laR "${base}" >&2
+              exit 1
+            fi
+            chmod +x "${BIN}"
+            echo "==> Verified binary for ${arch}:"
+            ls -l "${BIN}"
+            lipo -info "${BIN}"
           done
           ./Scripts/make_universal.sh
           lipo -info build/apps/universal/TargetPrint.app/Contents/MacOS/TargetPrint
@@ -288,7 +321,7 @@ jobs:
           path: ${{ env.PROJECT_ROOT }}/build/release-assets/vendor-iccery
 
       - name: Upload Release Assets to Gitea
-        if: ${{ startsWith(github.ref, 'refs/tags/') && !cancelled() }}
+        if: ${{ startsWith(github.ref, 'refs/tags/') && success() }}
         env:
           GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SERVER_URL: ${{ github.server_url }}