diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
deleted file mode 100644
index 101f619..0000000
--- a/.github/workflows/deploy.yml
+++ /dev/null
@@ -1,40 +0,0 @@
-name: Deploy to Cloudflare Pages
-
-on:
-  push:
-    branches:
-      - main
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      deployments: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci --legacy-peer-deps
-
-      - name: Build
-        env:
-          # The asset-heavy Astro build OOMs on the default ~2 GB Node heap.
-          NODE_OPTIONS: --max-old-space-size=8192
-        run: npm run build
-
-      - name: Deploy to Cloudflare Pages
-        uses: cloudflare/pages-action@v1
-        with:
-          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          projectName: goodwebtools
-          directory: dist
-          gitHubToken: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 923d4b6..9446ddd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -72,6 +72,9 @@ jobs:
             libxcb1-dev \
             libxcb-randr0-dev \
             libxcb-shm0-dev \
+            libgbm-dev \
+            libegl1-mesa-dev \
+            libgl1-mesa-dev \
             libclang-dev \
             clang \
             pkg-config
@@ -107,13 +110,12 @@ jobs:
           # Updater signing (required — tauri.conf.json declares a pubkey).
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          # Code signing — set these secrets in the repo settings
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          # Apple code signing / notarization is intentionally NOT wired: the
+          # APPLE_* secrets aren't set, and passing empty ones makes tauri-action
+          # attempt `security import` and fail ("failed to import keychain
+          # certificate"). macOS beta builds ship unsigned (Gatekeeper: right-click
+          # → Open). To enable signing, set the APPLE_* secrets (see
+          # RELEASING-DESKTOP.md) and re-add them here.
         with:
           tagName: ${{ github.ref_name }}
           releaseName: 'GoodWebTools Desktop ${{ github.ref_name }}'
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index ec979a8..5e0c773 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -77,7 +77,7 @@
   },
   "bundle": {
     "active": true,
-    "targets": "all",
+    "targets": ["nsis", "app", "dmg", "deb", "appimage"],
     "resources": [],
     "category": "Utility",
     "shortDescription": "Privacy-first client-side tools",