diff --git a/.github/workflows/macos-testing-build.yml b/.github/workflows/macos-testing-build.yml
new file mode 100644
index 000000000..c1bc1d84a
--- /dev/null
+++ b/.github/workflows/macos-testing-build.yml
@@ -0,0 +1,69 @@
+name: macOS testing build
+
+# Manual/tag macOS testing build. Click "Run workflow" in the Actions tab (or push a
+# 0.0.0-testing-* tag) and it builds the unsigned macOS app, cuts a prerelease tagged
+# 0.0.0-testing-<short-sha>, and attaches the .zip (the dmg maker is a follow-up).
+#
+# arm64 only: macos-latest runners are Apple Silicon, so this does not cover Intel.
+# Unsigned + not notarized: once downloaded the app is quarantined and Gatekeeper
+# blocks it. To open: right-click -> Open, or
+#   xattr -dr com.apple.quarantine "Agent Orchestrator.app"
+#
+# The daemon is compiled natively on the macOS runner by build-daemon.mjs during
+# premake (host == target), so the bundled ao is a real macOS arm64 binary.
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "0.0.0-testing-*"
+
+jobs:
+  build:
+    runs-on: macos-latest
+    permissions:
+      contents: write
+    defaults:
+      run:
+        working-directory: frontend
+    env:
+      # Pure-Go sqlite (modernc) needs no cgo.
+      CGO_ENABLED: 0
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: backend/go.mod
+          cache-dependency-path: backend/go.sum
+      - run: npm ci
+      - name: Build macOS app (unsigned)
+        # `npm run make` keeps the premake daemon build; --targets restricts to the
+        # zip maker (the only darwin maker configured today).
+        run: npm run make -- --targets @electron-forge/maker-zip
+      - name: Publish to a 0.0.0-testing-<sha> prerelease
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          # Tag push: use the pushed tag. Manual run: mint 0.0.0-testing-<sha>.
+          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
+            TAG="${GITHUB_REF_NAME}"
+          else
+            TAG="0.0.0-testing-${GITHUB_SHA::7}"
+          fi
+          # Creates the tag at this commit if it does not exist; idempotent on re-run.
+          # Shared with the Linux/Windows jobs on a tag push: distinct asset names, --clobber.
+          gh release create "$TAG" --prerelease --target "$GITHUB_SHA" --title "$TAG" \
+            --notes "Unsigned testing build. Not signed; for testing only." \
+            || true
+          # NUL-delimited to survive spaces in the app name ("Agent Orchestrator-...").
+          find out/make -type f -print0 | while IFS= read -r -d '' f; do
+            echo "uploading: $f"
+            gh release upload "$TAG" "$f" --clobber
+          done