diff --git a/CHANGELOG.md b/CHANGELOG.md
index df71989..afe7c6f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,7 +11,11 @@ Version numbers follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html
 
 ### Added
 
-- **GitHub Actions CI/CD** — automated build workflow (`.github/workflows/build.yml`) builds Windows `.exe` and Linux binary on every push to `main`. Creates a GitHub Release with artifacts when a `v*` tag is pushed.
+- **GitHub Actions CI/CD — macOS build** — `.github/workflows/build.yml` now also builds a macOS `.app` bundle (`macos-13`, Intel x86_64 / Rosetta) on every push to `main` and on `v*` tags. Released as `GDPRScanner_macos_x86_64.zip`.
+
+### Fixed
+
+- **CI — Windows artifact never uploaded** — PyInstaller `--onedir` puts the exe inside `dist/GDPRScanner/`, not at `dist/*.exe`. The artifact glob never matched, so no Windows build appeared in releases. A PowerShell packaging step now zips `dist\GDPRScanner\` into `GDPRScanner_windows_x64.zip` (mirroring the existing Linux step).
 - **`EFFORT_ESTIMATE.md`** — build effort estimate document covering component-by-component hour breakdowns and complexity drivers for the project.
 - **Settings → Security tab** — new dedicated pane in the Settings modal. Admin PIN and Viewer PIN groups moved here from the General tab, which now contains only Appearance and About. The Share modal's **Configure** button navigates directly to the Security tab.
 - **Viewer mode layout** — the sidebar, log panel, and progress bar are now hidden in viewer mode so results fill the full window width. The `🔍 GDPRScanner` brand is shown in the top-left of the topbar (replacing the sidebar header) at the same size and weight as the normal sidebar title.
diff --git a/README.md b/README.md
index aa58d31..9a07116 100644
--- a/README.md
+++ b/README.md
@@ -482,16 +482,32 @@ The document is dated and can be stored as evidence of ongoing compliance activi
 
 ---
 
-### Building the M365 app
+### Building the desktop app
 
-`build_gdpr.py` packages `gdpr_scanner.py` + `m365_connector.py` + `lang/` into a standalone native app — same PyInstaller / pywebview approach as `build.py`.
+`build_gdpr.py` packages `gdpr_scanner.py` + `m365_connector.py` + `lang/` into a standalone native app using PyInstaller + pywebview.
 
 ```bash
 python build_gdpr.py              # build for the current platform
-python build_gdpr.py --icons-only # regenerate icon_m365.icns / icon_m365.ico
+python build_gdpr.py --icons-only # regenerate icon_gdpr.icns / icon_gdpr.ico
 ```
 
-> **Note:** Same cross-compilation restriction applies — must build on the target platform.
+| Platform | Output | Native window |
+|---|---|---|
+| macOS | `dist/GDPRScanner.app` | WKWebView |
+| Windows | `dist/GDPRScanner/GDPRScanner.exe` | WebView2 (Edge) |
+| Linux | `dist/GDPRScanner/GDPRScanner` | GTK WebKit |
+
+> **Cross-compilation is not supported** — build on the target platform, or use the pre-built binaries from the [GitHub Releases](../../releases) page.
+
+**GitHub Actions** builds all three platforms automatically on every push to `main` and on `v*` tags. Pre-built zips are attached to each release:
+
+| File | Platform |
+|---|---|
+| `GDPRScanner_windows_x64.zip` | Windows 10/11 x64 |
+| `GDPRScanner_linux_x86_64.zip` | Ubuntu 22.04+ / Debian |
+| `GDPRScanner_macos_x86_64.zip` | macOS 12+ Intel / Apple Silicon (Rosetta) |
+
+> **macOS Gatekeeper:** the app is unsigned. On first launch right-click → **Open** to bypass the security warning.
 
 ---