diff --git a/.drone.jsonnet b/.drone.jsonnet
index caf5aca02..2ec9ac4aa 100644
--- a/.drone.jsonnet
+++ b/.drone.jsonnet
@@ -407,6 +407,9 @@ local docs_pipeline(name, image, extra_cmds=[], allow_fail=false) = {
   deb_builder(docker_base + 'debian-sid-builder', 'sid', 'debian/sid', arch='arm64'),
 
   // Macos builds:
-  mac_builder('macOS (Release)'),
+  mac_builder('macOS (Release)', extra_cmds=[
+    '../contrib/ci/drone-check-static-libs.sh',
+    '../contrib/ci/drone-static-upload.sh',
+  ]),
   mac_builder('macOS (Debug)', build_type='Debug'),
 ]
diff --git a/contrib/ci/drone-check-static-libs.sh b/contrib/ci/drone-check-static-libs.sh
index 98aeef857..0d919c7ca 100755
--- a/contrib/ci/drone-check-static-libs.sh
+++ b/contrib/ci/drone-check-static-libs.sh
@@ -7,7 +7,8 @@ set -o errexit
 
 bad=
 if [ "$DRONE_STAGE_OS" == "darwin" ]; then
-    if otool -L daemon/lokinet | grep -Ev '^daemon/lokinet:|^\t(/usr/lib/libSystem\.|/usr/lib/libc\+\+\.|/System/Library/Frameworks/CoreFoundation)'; then
+    if otool -L llarp/apple/org.lokinet.network-extension.systemextension/Contents/MacOS/org.lokinet.network-extension | \
+        grep -Ev '^llarp/apple:|^\t(/usr/lib/lib(System\.|c\+\+|objc)|/System/Library/Frameworks/(CoreFoundation|NetworkExtension|Foundation|Network)\.framework'; then
         bad=1
     fi
 elif [ "$DRONE_STAGE_OS" == "linux" ]; then
diff --git a/contrib/ci/drone-static-upload.sh b/contrib/ci/drone-static-upload.sh
index 9449ff6dd..6180b516f 100755
--- a/contrib/ci/drone-static-upload.sh
+++ b/contrib/ci/drone-static-upload.sh
@@ -47,6 +47,9 @@ elif [ -e build-docs ]; then
     archive="$base.tar.xz"
     cp -av build-docs/docs/mkdocs.yml build-docs/docs/markdown "$base"
     tar cJvf "$archive" "$base"
+elif [ -e build-mac ]; then
+    archive="$base.dmg"
+    mv build-mac/Lokinet*.dmg "$archive"
 else
     cp -av daemon/lokinet daemon/lokinet-vpn "$base"
     cp -av ../contrib/bootstrap/mainnet.signed "$base/bootstrap.signed"