diff --git a/ops/platform-acceptance/linux.sh b/ops/platform-acceptance/linux.sh
index d53579b..0138c3a 100755
--- a/ops/platform-acceptance/linux.sh
+++ b/ops/platform-acceptance/linux.sh
@@ -72,7 +72,8 @@ sudo systemctl is-active --quiet 1helm.service
 curl -fsS http://127.0.0.1:8123/api/setup/status >"$work/clean-health.json"
 [[ "$(readlink -f /opt/1helm/current)" == "/opt/1helm/releases/$VERSION-$OFFLINE_DIGEST" ]]
 RETAINED_IMAGE="/var/lib/1helm-oci-v1/shared-images/sha256/$IMAGE_DIGEST"
-[[ -d "$RETAINED_IMAGE" && "$(find "$RETAINED_IMAGE" -maxdepth 1 -type f -name '*.oci.tar' -exec sha256sum {} \; | awk '{print $1}')" == "$IMAGE_DIGEST" ]]
+sudo test -d "$RETAINED_IMAGE"
+[[ "$(sudo find "$RETAINED_IMAGE" -maxdepth 1 -type f -name '*.oci.tar' -exec sha256sum {} \; | awk '{print $1}')" == "$IMAGE_DIGEST" ]]
 
 # Resolve the newest immutable public Stable release distinct from this
 # candidate version. Candidate versions normally remain unchanged during
@@ -140,7 +141,8 @@ sudo systemctl is-active --quiet 1helm.service
 curl -fsS http://127.0.0.1:8123/api/setup/status >"$work/rollback-health.json"
 STATE_AFTER="$(sudo sha256sum "$MARKER" | awk '{print $1}')"
 [[ "$STATE_BEFORE" == "$STATE_AFTER" ]]
-[[ -d "$RETAINED_IMAGE" && "$(find "$RETAINED_IMAGE" -maxdepth 1 -type f -name '*.oci.tar' -exec sha256sum {} \; | awk '{print $1}')" == "$IMAGE_DIGEST" ]]
+sudo test -d "$RETAINED_IMAGE"
+[[ "$(sudo find "$RETAINED_IMAGE" -maxdepth 1 -type f -name '*.oci.tar' -exec sha256sum {} \; | awk '{print $1}')" == "$IMAGE_DIGEST" ]]
 sudo rm -rf -- "$FAILURE_RELEASE"
 
 export HELM_PREVIOUS_VERSION="$PREVIOUS_VERSION"
diff --git a/ops/platform-acceptance/runner-job-started.sh b/ops/platform-acceptance/runner-job-started.sh
index a51c0dc..b3d8c46 100755
--- a/ops/platform-acceptance/runner-job-started.sh
+++ b/ops/platform-acceptance/runner-job-started.sh
@@ -30,3 +30,22 @@ if not (
 ):
     raise SystemExit("Phase 4 runner refused an untrusted repository/ref/SHA/CI event.")
 PY
+
+# macOS only: prepare the dedicated signing account's login keychain for this
+# now-validated, trusted job. Code signing resolves its identity through the
+# keychain search list, but notarytool resolves its credential profile through
+# the session DEFAULT keychain, and a launchd runner job otherwise has no
+# default keychain, so notarization fails with "No Keychain password item
+# found". Set login as the default (and search) keychain and unlock it. The
+# password is read from a machine-local file owned by the runner account; it is
+# never stored in this repository or exported into the job environment.
+if [[ "$(uname)" == "Darwin" ]]; then
+  kc="$HOME/Library/Keychains/login.keychain-db"
+  kc_pw_file="$HOME/.config/1helm/mac-keychain-password"
+  if [[ -f "$kc" && -r "$kc_pw_file" ]]; then
+    security list-keychains -d user -s "$kc" /Library/Keychains/System.keychain >/dev/null 2>&1 || true
+    security default-keychain -d user -s "$kc" >/dev/null 2>&1 || true
+    security set-keychain-settings "$kc" >/dev/null 2>&1 || true
+    security unlock-keychain -p "$(cat "$kc_pw_file")" "$kc" >/dev/null 2>&1 || true
+  fi
+fi