diff --git a/CHANGELOG.md b/CHANGELOG.md
index c2b4c7f..1aeb318 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,6 +24,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Extracted exit-code logic into `compute_exit_code()` helper (pure function) with 8 unit tests covering gate pass/fail, CI mode, and hook `block` vs non-`block` modes.
   - Applies to both the single-chunk and auto-chunked (`--auto-chunk`) review paths.
 
+### Fixed — Install (macOS)
+
+- **macOS installer now strips Gatekeeper quarantine attributes (#313)**
+  - Prebuilt macOS binaries (`aarch64-apple-darwin`) are not Apple-notarized. When downloaded directly, macOS attaches `com.apple.quarantine` / `com.apple.provenance` xattrs and kills the binary with `Killed: 9` on first launch.
+  - `install.sh` now runs `xattr -dr` for both attributes on the installed binary on macOS (best-effort, non-fatal).
+  - Added a prominent `<details>` block in the README install section explaining the symptom, the manual `xattr` workaround for users who download the binary directly, and the `cargo` / Homebrew alternatives.
+
 ## [0.6.0] - 2026-06-14
 
 ### Added — Code Intelligence
diff --git a/README.md b/README.md
index 68f7d0d..b1868b3 100644
--- a/README.md
+++ b/README.md
@@ -48,6 +48,25 @@ curl -fsSL https://raw.githubusercontent.com/codecoradev/cora-cli/main/install-b
 > Or: `cargo install --git https://github.com/codecoradev/cora-cli`  
 > Pre-built binaries: [GitHub Releases](https://github.com/codecoradev/cora-cli/releases)
 
+<details>
+<summary><b>macOS note — binary killed on launch (<code>Killed: 9</code>)?</b></summary>
+
+The prebuilt `aarch64-apple-darwin` binary is not Apple-notarized. On macOS, downloaded
+binaries may be tagged with `com.apple.quarantine` / `com.apple.provenance` and killed by
+Gatekeeper with **no error message**.
+
+The `install.sh` installer strips these attributes automatically. If you downloaded the
+binary manually (e.g. `gh release download`), strip them yourself:
+
+```bash
+xattr -dr com.apple.quarantine /path/to/cora
+xattr -dr com.apple.provenance /path/to/cora
+```
+
+Or install via `cargo` / Homebrew to sidestep Gatekeeper entirely.
+
+</details>
+
 ### Authenticate
 
 ```bash
diff --git a/install.sh b/install.sh
index 63f95a8..ef624f6 100755
--- a/install.sh
+++ b/install.sh
@@ -141,6 +141,16 @@ install() {
 
     chmod +x "${INSTALL_DIR}/${BINARY_NAME}"
 
+    # macOS Gatekeeper workaround (#313): strip quarantine/provenance xattrs
+    # that the browser/curl attaches to downloaded binaries. Without this,
+    # macOS kills the unsigned binary with `Killed: 9` and no error message.
+    if [ "$OS" = "darwin" ] && command -v xattr >/dev/null 2>&1; then
+        # Best-effort — failures here are non-fatal (binary may already be clean).
+        xattr -dr com.apple.quarantine "${INSTALL_DIR}/${BINARY_NAME}" 2>/dev/null || true
+        xattr -dr com.apple.provenance "${INSTALL_DIR}/${BINARY_NAME}" 2>/dev/null || true
+        info "Stripped macOS quarantine attributes (Gatekeeper workaround)"
+    fi
+
     # Cleanup
     rm -rf "$TEMP_DIR"