diff --git a/scripts/connect-release-record.mjs b/scripts/connect-release-record.mjs
index 298d11e..a54fc9f 100644
--- a/scripts/connect-release-record.mjs
+++ b/scripts/connect-release-record.mjs
@@ -162,6 +162,11 @@ function websiteArtifact(assets, version, platform, detail, pattern, trust, labe
   };
 }
 
+// The release workflow marks every macOS artifact that was not Developer ID
+// signed and notarized with an -UNSIGNED filename suffix.
 function macTrust(channel) {
-  return channel === "stable" ? "Signed and notarized" : "Beta preview · not notarized";
+  return (file) => {
+    if (/-UNSIGNED\.dmg$/.test(file)) return "Beta preview · not notarized";
+    return channel === "stable" ? "Signed and notarized" : "Beta preview · notarized";
+  };
 }
diff --git a/scripts/connect-release-record.test.mjs b/scripts/connect-release-record.test.mjs
index c88cf92..600923e 100644
--- a/scripts/connect-release-record.test.mjs
+++ b/scripts/connect-release-record.test.mjs
@@ -63,6 +63,15 @@ test("derives the website record from verified release evidence", () => {
   assert.equal(record.channelManifestUrl, `https://github.com/mdbase-dev/mdbase-connect/releases/download/${tag}/mdbase-connect-channel-v1.json`);
 });
 
+test("labels macOS downloads from their notarization marker", () => {
+  assert.equal(build().desktop[0].trust, "Beta preview · notarized");
+  const unsignedName = `mdbase-connect-${version}-macos-arm64-UNSIGNED.dmg`;
+  const unsigned = { ...release, assets: release.assets.map((asset) => asset.name === names[0] ? { ...asset, name: unsignedName } : asset) };
+  const record = build({ release: unsigned });
+  assert.equal(record.desktop[0].trust, "Beta preview · not notarized");
+  assert.equal(record.desktop[1].trust, "Beta preview · notarized");
+});
+
 test("rejects inconsistent release evidence and duplicate artifacts", () => {
   assert.throws(() => build({ npmVersion: "0.1.0-beta.83" }), /SDK version/);
   assert.throws(() => build({ channel: { ...channel, tag: "v0.1.0-beta.83" } }), /manifest tag/);
diff --git a/src/data/connect-release.json b/src/data/connect-release.json
index a84b48f..d904f02 100644
--- a/src/data/connect-release.json
+++ b/src/data/connect-release.json
@@ -12,7 +12,7 @@
     {
       "platform": "macOS",
       "detail": "Apple Silicon",
-      "trust": "Beta preview · not notarized",
+      "trust": "Beta preview · notarized",
       "file": "mdbase-connect-0.1.0-beta.121-macos-arm64.dmg",
       "size": 140657138,
       "sha256": "f65580e68296e44f02754113c025322f895c7007a1b947f57a44a8e337208922",
@@ -21,7 +21,7 @@
     {
       "platform": "macOS",
       "detail": "Intel",
-      "trust": "Beta preview · not notarized",
+      "trust": "Beta preview · notarized",
       "file": "mdbase-connect-0.1.0-beta.121-macos-x64.dmg",
       "size": 147641847,
       "sha256": "135dc3896aea83585faac70f46bb822e2f9f3d1bfa60487600ac1dc21ead2228",
diff --git a/src/pages/downloads/index.astro b/src/pages/downloads/index.astro
index a7b250d..6fb10e7 100644
--- a/src/pages/downloads/index.astro
+++ b/src/pages/downloads/index.astro
@@ -8,7 +8,7 @@ const desktopDownloads = release.desktop;
 const cliDownloads = release.cli;
 const macDownloadsSigned = desktopDownloads
   .filter(({ platform }) => platform === "macOS")
-  .every(({ trust }) => trust === "Signed and notarized");
+  .every(({ trust }) => trust === "Signed and notarized" || trust === "Beta preview · notarized");
 const published = new Date(release.publishedAt);
 const releaseSize = (bytes: number) => `${Math.round(bytes / 1_000_000)} MB`;
 ---