diff --git a/.drone.jsonnet b/.drone.jsonnet
index 77014c4ce..ff392384f 100644
--- a/.drone.jsonnet
+++ b/.drone.jsonnet
@@ -90,6 +90,34 @@ local deb_builder(image, distro, distro_branch, arch='amd64', imaginary_repo=fal
     ]
 };
 
+// Macos build
+local mac_builder(name, build_type='Release', werror=true, cmake_extra='', extra_cmds=[], allow_fail=false) = {
+    kind: 'pipeline',
+    type: 'exec',
+    name: name,
+    platform: { os: 'darwin', arch: 'amd64' },
+    steps: [
+        {
+            name: 'build',
+            environment: { SSH_KEY: { from_secret: "SSH_KEY" } },
+            commands: [
+                // If you don't do this then the C compiler doesn't have an include path containing
+                // basic system headers.  WTF apple:
+                'export SDKROOT="$(xcrun --sdk macosx --show-sdk-path)"',
+                'git submodule update --init --recursive',
+                'mkdir build',
+                'cd build',
+                'cmake .. -G Ninja -DCMAKE_CXX_FLAGS=-fcolor-diagnostics -DCMAKE_BUILD_TYPE='+build_type+' ' +
+                    (if werror then '-DWARNINGS_AS_ERRORS=ON ' else '') +
+                    cmake_extra,
+                'ninja -v',
+                './test/testAll --gtest_color=yes',
+                './test/catchAll --use-colour yes',
+            ] + extra_cmds,
+        }
+    ]
+};
+
 
 [
     {
@@ -136,26 +164,12 @@ local deb_builder(image, distro, distro_branch, arch='amd64', imaginary_repo=fal
     deb_builder("ubuntu:focal", "focal", "ubuntu/focal"),
     deb_builder("debian:sid", "sid", "debian/sid", arch='arm64'),
 
-    // Macos build
-    {
-        kind: 'pipeline',
-        type: 'exec',
-        name: 'macOS (Catalina w/macports)',
-        platform: { os: 'darwin', arch: 'amd64' },
-        environment: { CLICOLOR_FORCE: '1' }, // Lets color through ninja (1.9+)
-        steps: [
-            {
-                name: 'build',
-                commands: [
-                    'git submodule update --init --recursive',
-                    'mkdir build',
-                    'cd build',
-                    'cmake .. -G Ninja -DCMAKE_CXX_FLAGS=-fcolor-diagnostics -DCMAKE_BUILD_TYPE=Release -DWARNINGS_AS_ERRORS=ON',
-                    'ninja -v',
-                    './test/testAll --gtest_color=yes',
-                    './test/catchAll --use-colour yes',
-                ],
-            }
-        ]
-    },
+    // Macos builds:
+    mac_builder('macOS (Release)'),
+    mac_builder('macOS (Debug)', build_type='Debug'),
+    mac_builder('macOS (Static)', cmake_extra='-DBUILD_SHARED_LIBS=OFF -DSTATIC_LINK=ON -DDOWNLOAD_SODIUM=FORCE -DDOWNLOAD_CURL=FORCE -DDOWNLOAD_UV=FORCE',
+                extra_cmds=[
+                    '../contrib/ci/drone-check-static-libs.sh',
+                    '../contrib/ci/drone-static-upload.sh'
+                ]),
 ]
diff --git a/contrib/ci/drone-check-static-libs.sh b/contrib/ci/drone-check-static-libs.sh
index 040bb04ff..ad0fa8d73 100755
--- a/contrib/ci/drone-check-static-libs.sh
+++ b/contrib/ci/drone-check-static-libs.sh
@@ -1,11 +1,25 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # Script used with Drone CI to check that a statically build lokinet only links against the expected
 # base system libraries.  Expects to be run with pwd of the build directory.
 
 set -o errexit
 
-if ldd daemon/lokinet | grep -Ev '(linux-vdso|ld-linux-x86-64|lib(pthread|dl|rt|stdc\+\+|gcc_s|c|m))\.so'; then
+bad=
+if [ "$DRONE_STAGE_OS" == "darwin" ]; then
+    if otool -L daemon/lokinet | grep -Ev '^daemon/lokinet:|^\t(/usr/lib/libSystem\.|/usr/lib/libc\+\+\.|/System/Library/Frameworks/CoreFoundation)'; then
+        bad=1
+    fi
+elif [ "$DRONE_STAGE_OS" == "linux" ]; then
+    if ldd daemon/lokinet | grep -Ev '(linux-vdso|ld-linux-x86-64|lib(pthread|dl|rt|stdc\+\+|gcc_s|c|m))\.so'; then
+        bad=1
+    fi
+else
+    echo -e "\n\n\n\n\e[31;1mDon't know how to check linked libs on $DRONE_STAGE_OS\e[0m\n\n\n"
+    exit 1
+fi
+
+if [ -n "$bad" ]; then
     echo -e "\n\n\n\n\e[31;1mlokinet links to unexpected libraries\e[0m\n\n\n"
     exit 1
 fi
diff --git a/contrib/ci/drone-static-upload.sh b/contrib/ci/drone-static-upload.sh
index 627bbc2d5..c639e0506 100755
--- a/contrib/ci/drone-static-upload.sh
+++ b/contrib/ci/drone-static-upload.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # Script used with Drone CI to upload build artifacts (because specifying all this in
 # .drone.jsonnet is too painful).
@@ -13,19 +13,19 @@ if [ -z "$SSH_KEY" ]; then
     exit 0
 fi
 
-echo "$SSH_KEY" >~/ssh_key
+echo "$SSH_KEY" >ssh_key
 
 set -o xtrace  # Don't start tracing until *after* we write the ssh key
 
-chmod 600 ~/ssh_key
+chmod 600 ssh_key
 
 if [ -n "$DRONE_TAG" ]; then
     # For a tag build use something like `lokinet-linux-amd64-v1.2.3`
-    base="lokinet-linux-$DRONE_STAGE_ARCH-$DRONE_TAG"
+    base="lokinet-$DRONE_STAGE_OS-$DRONE_STAGE_ARCH-$DRONE_TAG"
 else
     # Otherwise build a length name from the datetime and commit hash, such as:
     # lokinet-linux-amd64-20200522T212342Z-04d7dcc54
-    base="lokinet-linux-$DRONE_STAGE_ARCH-$(date --date=@$DRONE_BUILD_CREATED +%Y%m%dT%H%M%SZ)-${DRONE_COMMIT:0:9}"
+    base="lokinet-$DRONE_STAGE_OS-$DRONE_STAGE_ARCH-$(date --date=@$DRONE_BUILD_CREATED +%Y%m%dT%H%M%SZ)-${DRONE_COMMIT:0:9}"
 fi
 
 mkdir -v "$base"
@@ -47,7 +47,7 @@ for p in "${upload_dirs[@]}"; do
 -mkdir $dir_tmp"
 done
 
-sftp -i ~/ssh_key -b - -o StrictHostKeyChecking=off drone@builds.lokinet.dev <<SFTP
+sftp -i ssh_key -b - -o StrictHostKeyChecking=off drone@builds.lokinet.dev <<SFTP
 $mkdirs
 put $base.tar.xz $upload_to
 SFTP