diff --git a/cc-haha/desktop/scripts/build-macos-arm64.sh b/cc-haha/desktop/scripts/build-macos-arm64.sh
index 2ff328b..ad4c755 100755
--- a/cc-haha/desktop/scripts/build-macos-arm64.sh
+++ b/cc-haha/desktop/scripts/build-macos-arm64.sh
@@ -12,6 +12,7 @@ CANONICAL_OUTPUT_DIR="${DESKTOP_DIR}/build-artifacts/macos-arm64"
 APP_BUNDLE_NAME="HeiCode.app"
 APP_BUNDLE_ID="com.heicode.desktop"
 DMG_VOLUME_NAME="Heicode"
+CODESIGN_IDENTITY="${CODESIGN_IDENTITY:-Developer ID Application: zhiyong Gong (R49P76Q59F)}"
 APP_VERSION="$(bun -e "console.log(require('${DESKTOP_DIR}/src-tauri/tauri.conf.json').version)" 2>/dev/null || echo "0.0.0")"
 DEFAULT_DMG_BASENAME="Heicode_${APP_VERSION}_aarch64.dmg"
 
@@ -25,6 +26,9 @@ Usage:
 Environment:
   SKIP_INSTALL=1   Skip `bun install` in the repo root and desktop app.
   SIGN_BUILD=1     Remove the default `--no-sign` flag and allow signed builds.
+  CODESIGN_IDENTITY
+                   Signing identity used when SIGN_BUILD=1.
+                   Defaults to "Developer ID Application: zhiyong Gong (R49P76Q59F)".
   OPEN_OUTPUT=1    Open the canonical artifact output directory in Finder after a successful build.
 
 Examples:
@@ -245,7 +249,15 @@ sign_canonical_app_bundle() {
   # fails strict bundle validation once Resources/icon.icns exists. Sign only
   # the outer bundle: do not pass --deep, because re-signing claude-sidecar
   # changes its code-signature hash and breaks existing macOS Keychain ACLs.
-  codesign --force --sign - --timestamp=none "${app_bundle}"
+  if [[ "${SIGN_BUILD:-0}" == "1" ]]; then
+    codesign --force \
+      --sign "${CODESIGN_IDENTITY}" \
+      --options runtime \
+      --timestamp \
+      "${app_bundle}"
+  else
+    codesign --force --sign - --timestamp=none "${app_bundle}"
+  fi
 
   if [[ -x "${sidecar}" ]]; then
     sidecar_cdhash_after="$(codesign_cdhash "${sidecar}")"
diff --git a/cc-haha/desktop/src-tauri/Cargo.lock b/cc-haha/desktop/src-tauri/Cargo.lock
index 69a3ae4..b169538 100644
--- a/cc-haha/desktop/src-tauri/Cargo.lock
+++ b/cc-haha/desktop/src-tauri/Cargo.lock
@@ -1525,7 +1525,7 @@ checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
 name = "heicode-desktop"
-version = "0.1.8"
+version = "0.2.1"
 dependencies = [
  "anyhow",
  "portable-pty",
diff --git a/cc-haha/desktop/src-tauri/tauri.macos.conf.json b/cc-haha/desktop/src-tauri/tauri.macos.conf.json
index ad558ca..dd940d8 100644
--- a/cc-haha/desktop/src-tauri/tauri.macos.conf.json
+++ b/cc-haha/desktop/src-tauri/tauri.macos.conf.json
@@ -14,5 +14,12 @@
         "acceptFirstMouse": true
       }
     ]
+  },
+  "bundle": {
+    "macOS": {
+      "signingIdentity": "Developer ID Application: zhiyong Gong (R49P76Q59F)",
+      "hardenedRuntime": true,
+      "providerShortName": "R49P76Q59F"
+    }
   }
 }
diff --git a/heicode/electron/package.json b/heicode/electron/package.json
index bc02919..d39a4d3 100644
--- a/heicode/electron/package.json
+++ b/heicode/electron/package.json
@@ -46,9 +46,9 @@
     "mac": {
       "category": "public.app-category.developer-tools",
       "icon": "icon.png",
-      "identity": null,
-      "hardenedRuntime": false,
-      "gatekeeperAssess": false,
+      "identity": "Developer ID Application: zhiyong Gong (R49P76Q59F)",
+      "hardenedRuntime": true,
+      "gatekeeperAssess": true,
       "entitlements": "entitlements.mac.plist",
       "entitlementsInherit": "entitlements.mac.plist",
       "target": [
@@ -98,4 +98,4 @@
       "allowToChangeInstallationDirectory": true
     }
   }
-}
\ No newline at end of file
+}