diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8c8ab55..bef2443 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -616,7 +616,7 @@ jobs:
       ((endsWith(github.repository, 'pulseview')) ||
       (endsWith(github.repository, 'sigrok-build')))
 
-    runs-on: macos-13
+    runs-on: macos-15-intel
 
 # Note: For now, we only supply debug builds
 #    strategy:
@@ -817,7 +817,7 @@ jobs:
       ((endsWith(github.repository, 'sigrok-cli')) ||
       (endsWith(github.repository, 'sigrok-build')))
 
-    runs-on: macos-13
+    runs-on: macos-15-intel
 
     env:
       TARGET: "x86"
diff --git a/ci/macos/sigrok-macos-create-dmg.sh b/ci/macos/sigrok-macos-create-dmg.sh
index 8f61f15..099a380 100755
--- a/ci/macos/sigrok-macos-create-dmg.sh
+++ b/ci/macos/sigrok-macos-create-dmg.sh
@@ -42,6 +42,10 @@ PYTHON_PREFIX_DIR=$(brew --prefix "$BREW_PYTHON_VERSION")
 # Get Python version
 PYTHON_VERSION=$(python3 -c 'import sys; print(".".join(map(str, sys.version_info[0:2])))')
 
+DBUS_DYLIB_PATH=$(brew list dbus | grep dylib | sort -n | head -n 1)
+DBUS_PREFIX=$(brew --prefix dbus)
+DBUS_DYLIB=$(basename "$DBUS_DYLIB_PATH")
+
 DMG_BUILD_DIR=./build_dmg
 mkdir $DMG_BUILD_DIR
 cd $DMG_BUILD_DIR
@@ -74,16 +78,22 @@ if [ "$ARTIFACT_BIN_NAME" = "pulseview" ]; then
 	# cp $BOOSTLIBDIR/libboost_chrono-mt.dylib $FRAMEWORKS_DIR
 	# chmod 644 $FRAMEWORKS_DIR/*boost*
 
+	# Copy libdbus into bundle
+	cp "$DBUS_DYLIB_PATH" $FRAMEWORKS_DIR/
+	chmod 644 "$FRAMEWORKS_DIR/$DBUS_DYLIB"
+
 	# Copy QtDBus framework files
-	cp -r $QT_DIR/Frameworks/QtDBus.framework $FRAMEWORKS_DIR/
+	cp -R $(readlink -f "$QT_DIR/Frameworks/QtDBus.framework") $FRAMEWORKS_DIR/
+	chmod -R o+w "$FRAMEWORKS_DIR/QtDBus.framework"
+	rm -rf "$FRAMEWORKS_DIR/QtDBus.framework/_CodeSignature"
 fi
 
-"$QT_BIN_DIR"/macdeployqt $ARTIFACT_TITLE.app
-
 # Copy Python framework and fix it up.
 cp -R "$PYTHON_FRAMEWORK_DIR" $FRAMEWORKS_DIR
 chmod 644 "$PYTHON_DIR"/lib/libpython*.dylib
-rm -rf "$PYTHON_DIR"/Headers
+# Keep the actual headers dir, just wipe contents, to avoid
+# dangling symlink/codesigning failures
+rm -rf "$PYTHON_DIR"/Headers/*
 rm -rf "$PYTHON_DIR"/bin
 rm -rf "$PYTHON_DIR"/include
 rm -rf "$PYTHON_DIR"/share
@@ -99,9 +109,31 @@ rm -rf "$PYTHON_DIR"/lib/python$PYTHON_VERSION/unittest
 rm -rf "$PYTHON_DIR"/lib/python$PYTHON_VERSION/__pycache__
 rm -rf "$PYTHON_DIR"/lib/python$PYTHON_VERSION/**/__pycache__
 rm -rf "$PYTHON_DIR"/lib/python$PYTHON_VERSION/**/**/__pycache__
-rm -rf "$PYTHON_DIR"/Resources
+rm -rf "$PYTHON_DIR"/lib/python$PYTHON_VERSION/site-packages
+# retain Info.plist to avoid codesigning failures
+rm -rf "$PYTHON_DIR"/Resources/Python.app
+rm -rf "$PYTHON_DIR"/_CodeSignature
 
 # Replace paths
+install_name_tool -id \
+	"@executable_path/../Frameworks/$DBUS_DYLIB" \
+	"$FRAMEWORKS_DIR/$DBUS_DYLIB"
+
+install_name_tool -id \
+	@executable_path/../Frameworks/QtDBus.framework/Versions/A/QtDBus \
+	"$FRAMEWORKS_DIR/QtDBus.framework/Versions/A/QtDBus"
+
+install_name_tool -change \
+    "$DBUS_PREFIX/lib/$DBUS_DYLIB" \
+	"@executable_path/../Frameworks/$DBUS_DYLIB" \
+	"$FRAMEWORKS_DIR/QtDBus.framework/Versions/A/QtDBus"
+
+install_name_tool -id \
+	@executable_path/../Frameworks/Python.framework/Versions/$PYTHON_VERSION/Python \
+	"$PYTHON_DIR"/Python
+
+"$QT_BIN_DIR"/macdeployqt $ARTIFACT_TITLE.app -libpath="$QT_DIR/lib"
+
 install_name_tool -change \
 	"$PYTHON_PREFIX_DIR"/Frameworks/Python.framework/Versions/$PYTHON_VERSION/Python \
 	@executable_path/../Frameworks/Python.framework/Versions/$PYTHON_VERSION/Python \
@@ -125,10 +157,11 @@ xsltproc --stringparam VERSION "${ARTIFACT_VERSION}" -o $CONTENTS_DIR/Info.plist
 	../contrib-macos/Info-${ARTIFACT_BIN_NAME}.xslt ../contrib-macos/Info-${ARTIFACT_BIN_NAME}.plist
 cp ../contrib-macos/${ARTIFACT_BIN_NAME}.icns $CONTENTS_DIR/Resources
 
+codesign --force --deep --sign - "$ARTIFACT_TITLE.app"
+
 hdiutil create "${ARTIFACT_TITLE}-${ARTIFACT_VERSION}-${TARGET}.dmg" \
 	-volname "$ARTIFACT_TITLE $ARTIFACT_VERSION" \
 	-fs HFS+ -srcfolder "$ARTIFACT_TITLE.app"
 
 # Move DMG to parent directory, so it is accessible without knowing $DMG_BUILD_DIR
 mv "${ARTIFACT_TITLE}-${ARTIFACT_VERSION}-${TARGET}.dmg" ..
-