diff --git a/.github/workflows/dcm-desktop-release.yml b/.github/workflows/dcm-desktop-release.yml
new file mode 100644
index 00000000000..346682417fc
--- /dev/null
+++ b/.github/workflows/dcm-desktop-release.yml
@@ -0,0 +1,719 @@
+name: DCM Desktop Release
+
+# Divine Creative Ministries desktop release lane.
+#
+# Builds the Buzz desktop app from a `dcm-desktop-v*` tag that must point
+# into dcm-production history, and publishes the installers to this fork's
+# GitHub Releases. This is a DCM-only addition: it does not modify the
+# upstream release lane (release.yml), which stays gated to block/buzz.
+#
+# macOS signing + notarization activate automatically when the DCM Apple
+# secrets are configured (see docs/DCM_DESKTOP_RELEASES.md). Without them
+# the lane still works and produces clearly-labelled unsigned builds.
+# Windows and Linux artifacts are unsigned, matching the upstream OSS lane.
+#
+# No auto-updater: artifacts install manually. The Tauri updater stays
+# unconfigured (base tauri.conf.json has empty endpoints), so no Tauri
+# updater signing key is required.
+
+concurrency:
+  group: dcm-desktop-release-${{ github.ref }}
+  cancel-in-progress: false
+
+on:
+  push:
+    tags:
+      - 'dcm-desktop-v[0-9]*'
+
+jobs:
+  setup:
+    name: Setup
+    if: github.repository == 'Divine-Creative-Ministries/buzz'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      source_sha: ${{ steps.source.outputs.source_sha }}
+      sign: ${{ steps.signing.outputs.sign }}
+    steps:
+      - name: Determine version
+        id: version
+        run: echo "version=${GITHUB_REF_NAME#dcm-desktop-v}" >> "$GITHUB_OUTPUT"
+
+      - name: Validate version
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          # Full semver core + prerelease grammar (no build metadata): rejects
+          # leading zeros and empty prerelease identifiers (e.g. 1.2.3-beta..1)
+          # that would otherwise fail later inside Cargo/Tauri version patching.
+          SEMVER='^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-(0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(\.(0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?$'
+          if ! echo "$VERSION" | grep -qE "$SEMVER"; then
+            echo "::error::Invalid version '$VERSION'. Expected strict semver (e.g. 0.1.0 or 0.1.0-beta.1)"
+            exit 1
+          fi
+
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Verify tag points into dcm-production history
+        id: source
+        run: |
+          set -euo pipefail
+          git fetch --no-tags origin dcm-production
+          TAG_SHA=$(git rev-parse 'HEAD^{commit}')
+          if ! git merge-base --is-ancestor "$TAG_SHA" origin/dcm-production; then
+            echo "::error::Tag commit $TAG_SHA is not an ancestor of origin/dcm-production. DCM desktop releases must be cut from reviewed dcm-production history."
+            exit 1
+          fi
+          echo "source_sha=$TAG_SHA" >> "$GITHUB_OUTPUT"
+
+      - name: Detect macOS signing configuration
+        id: signing
+        env:
+          HAS_CERT: ${{ secrets.DCM_APPLE_CERTIFICATE != '' }}
+          HAS_CERT_PASSWORD: ${{ secrets.DCM_APPLE_CERTIFICATE_PASSWORD != '' }}
+          HAS_IDENTITY: ${{ secrets.DCM_APPLE_SIGNING_IDENTITY != '' }}
+          HAS_API_ISSUER: ${{ secrets.DCM_APPLE_API_ISSUER != '' }}
+          HAS_API_KEY: ${{ secrets.DCM_APPLE_API_KEY != '' }}
+          HAS_API_KEY_CONTENT: ${{ secrets.DCM_APPLE_API_KEY_CONTENT != '' }}
+        run: |
+          set -euo pipefail
+          if [[ "$HAS_CERT" == "true" ]]; then
+            # Refuse a half-configured signing setup: a build signed without
+            # notarization (or vice versa) looks done but fails on install.
+            for flag in HAS_CERT_PASSWORD HAS_IDENTITY HAS_API_ISSUER HAS_API_KEY HAS_API_KEY_CONTENT; do
+              if [[ "${!flag}" != "true" ]]; then
+                echo "::error::DCM_APPLE_CERTIFICATE is set but ${flag#HAS_} secret is missing. Configure all six DCM_APPLE_* secrets (docs/DCM_DESKTOP_RELEASES.md) or remove DCM_APPLE_CERTIFICATE to build unsigned."
+                exit 1
+              fi
+            done
+            echo "sign=true" >> "$GITHUB_OUTPUT"
+            echo "macOS signing: enabled"
+          else
+            echo "sign=false" >> "$GITHUB_OUTPUT"
+            echo "macOS signing: disabled (DCM_APPLE_CERTIFICATE not set) — artifacts will be marked unsigned"
+          fi
+
+  release-macos-arm64:
+    name: Release macOS (Apple Silicon)
+    runs-on: macos-latest
+    needs: setup
+    timeout-minutes: 60
+    permissions:
+      contents: read
+    env:
+      VERSION: ${{ needs.setup.outputs.version }}
+      SIGN: ${{ needs.setup.outputs.sign }}
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          ref: ${{ needs.setup.outputs.source_sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
+
+      - name: Install desktop dependencies
+        run: just desktop-install-ci
+
+      - name: Patch version
+        run: |
+          cd desktop && node scripts/set-version-from-tag.mjs "$VERSION"
+          cd src-tauri && cargo update --workspace
+
+      - name: Write DCM release config overlay
+        run: |
+          printf '{"bundle":{"macOS":{"minimumSystemVersion":"10.15"}}}' \
+            > desktop/src-tauri/tauri.dcm-release.conf.json
+
+      - name: Build sidecars
+        run: |
+          cargo build --release -p buzz-acp -p buzz-agent -p buzz-backend-kubernetes -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli
+          ./scripts/bundle-sidecars.sh
+
+      # Mesh rev derived from Cargo.lock (no lockstep edit on dep bump); cache
+      # key tracks it. Same machinery as the upstream release lane so the DCM
+      # Apple Silicon build keeps feature parity (--features mesh-llm).
+      - name: Resolve mesh-llm rev
+        id: mesh_rev
+        run: |
+          set -euo pipefail
+          REV=$(python3 -c 'import tomllib; d=tomllib.load(open("Cargo.lock", "rb")); p=next(p for p in d["package"] if p["name"] == "mesh-llm-sdk"); print(p["source"].rsplit("#", 1)[1])')
+          [[ -n "$REV" ]] || { echo "::error::could not resolve mesh-llm rev from Cargo.lock"; exit 1; }
+          echo "rev=$REV" >> "$GITHUB_OUTPUT"
+          echo "short=${REV:0:7}" >> "$GITHUB_OUTPUT"
+      - name: Restore mesh llama build cache
+        id: llama_cache
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
+        with:
+          path: ${{ github.workspace }}/.cache/mesh-llama
+          key: mesh-llama-${{ runner.os }}-metal-${{ steps.mesh_rev.outputs.rev }}
+      - name: Build mesh llama native libraries
+        if: steps.llama_cache.outputs.cache-hit != 'true'
+        env:
+          MESH_REV_SHORT: ${{ steps.mesh_rev.outputs.short }}
+        run: |
+          set -euo pipefail
+          cargo fetch --manifest-path desktop/src-tauri/Cargo.toml
+          SHORT="$MESH_REV_SHORT"
+          MESH_ROOT=$(find "${CARGO_HOME:-$HOME/.cargo}/git/checkouts" -path "*/$SHORT" -type d -name "$SHORT" | head -1)
+          if [[ -z "$MESH_ROOT" ]]; then
+            echo "::error::mesh-llm checkout for $SHORT not found after cargo fetch"
+            exit 1
+          fi
+          export LLAMA_STAGE_BACKEND=metal
+          export LLAMA_STAGE_BUILD_DIR="$GITHUB_WORKSPACE/.cache/mesh-llama/build-stage-abi-metal"
+          export CMAKE_OSX_DEPLOYMENT_TARGET=10.15
+          "$MESH_ROOT/scripts/prepare-llama.sh" pinned
+          "$MESH_ROOT/scripts/build-llama.sh" -DCMAKE_OSX_DEPLOYMENT_TARGET=10.15
+      - name: Save mesh llama build cache
+        if: steps.llama_cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
+        with:
+          path: ${{ github.workspace }}/.cache/mesh-llama
+          key: mesh-llama-${{ runner.os }}-metal-${{ steps.mesh_rev.outputs.rev }}
+
+      - name: Stage Apple notarization API key
+        if: env.SIGN == 'true'
+        env:
+          DCM_APPLE_API_KEY_CONTENT: ${{ secrets.DCM_APPLE_API_KEY_CONTENT }}
+        run: |
+          set -euo pipefail
+          printf '%s' "$DCM_APPLE_API_KEY_CONTENT" | base64 -d > "${RUNNER_TEMP}/apple-api-key.p8"
+
+      - name: Build signed Tauri app
+        if: env.SIGN == 'true'
+        run: cd desktop && pnpm tauri build --verbose --features mesh-llm --config src-tauri/tauri.dcm-release.conf.json
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.DCM_APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.DCM_APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ secrets.DCM_APPLE_SIGNING_IDENTITY }}
+          APPLE_API_ISSUER: ${{ secrets.DCM_APPLE_API_ISSUER }}
+          APPLE_API_KEY: ${{ secrets.DCM_APPLE_API_KEY }}
+          APPLE_API_KEY_PATH: ${{ runner.temp }}/apple-api-key.p8
+          CMAKE_POLICY_VERSION_MINIMUM: "3.5"
+          MACOSX_DEPLOYMENT_TARGET: "10.15"
+          CMAKE_OSX_DEPLOYMENT_TARGET: "10.15"
+          LLAMA_STAGE_BACKEND: metal
+          LLAMA_STAGE_BUILD_DIR: ${{ github.workspace }}/.cache/mesh-llama/build-stage-abi-metal
+          SKIPPY_LLAMA_AUTO_BUILD: "0"
+          TAURI_BUNDLER_DMG_IGNORE_CI: "true"
+
+      - name: Build unsigned Tauri app
+        if: env.SIGN != 'true'
+        run: cd desktop && pnpm tauri build --verbose --no-sign --features mesh-llm --config src-tauri/tauri.dcm-release.conf.json
+        env:
+          CMAKE_POLICY_VERSION_MINIMUM: "3.5"
+          MACOSX_DEPLOYMENT_TARGET: "10.15"
+          CMAKE_OSX_DEPLOYMENT_TARGET: "10.15"
+          LLAMA_STAGE_BACKEND: metal
+          LLAMA_STAGE_BUILD_DIR: ${{ github.workspace }}/.cache/mesh-llama/build-stage-abi-metal
+          SKIPPY_LLAMA_AUTO_BUILD: "0"
+          TAURI_BUNDLER_DMG_IGNORE_CI: "true"
+
+      - name: Verify code signature
+        if: env.SIGN == 'true'
+        run: |
+          codesign --verify --deep --strict --verbose=2 \
+            desktop/src-tauri/target/release/bundle/macos/Buzz.app
+          spctl --assess --type execute --verbose=4 \
+            desktop/src-tauri/target/release/bundle/macos/Buzz.app
+          desktop/scripts/verify-macos-entitlements.sh \
+            desktop/src-tauri/target/release/bundle/macos/Buzz.app
+
+      - name: Locate and label DMG
+        id: artifacts
+        run: |
+          set -euo pipefail
+          BUNDLE_DIR="desktop/src-tauri/target/release/bundle"
+          DMG=$(find "$BUNDLE_DIR/dmg" -name '*.dmg' -type f | head -1)
+          if [[ -z "$DMG" ]]; then
+            echo "::error::No DMG found in $BUNDLE_DIR/dmg"
+            exit 1
+          fi
+          RENAMED="$(dirname "$DMG")/Buzz_${VERSION}_aarch64.dmg"
+          if [[ "$SIGN" != "true" ]]; then
+            # Cosmetic Finder patch repacks the DMG, so it is only safe on
+            # unsigned builds — on signed builds it would invalidate the
+            # signature and notarization ticket Tauri just produced.
+            desktop/scripts/set-dmg-finder-text-size.sh "$DMG" 14
+            RENAMED="$(dirname "$DMG")/Buzz_${VERSION}_aarch64_unsigned.dmg"
+          fi
+          if [[ "$DMG" != "$RENAMED" ]]; then
+            mv "$DMG" "$RENAMED"
+          fi
+          echo "dmg=$RENAMED" >> "$GITHUB_OUTPUT"
+
+      - name: Stage Apple Silicon release artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: dcm-desktop-macos-arm64
+          if-no-files-found: error
+          path: ${{ steps.artifacts.outputs.dmg }}
+
+  release-macos-x64:
+    name: Release macOS (Intel)
+    runs-on: macos-latest
+    needs: setup
+    timeout-minutes: 60
+    permissions:
+      contents: read
+    env:
+      VERSION: ${{ needs.setup.outputs.version }}
+      SIGN: ${{ needs.setup.outputs.sign }}
+      TARGET: x86_64-apple-darwin
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          ref: ${{ needs.setup.outputs.source_sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
+
+      - name: Install desktop dependencies
+        run: just desktop-install-ci
+
+      - name: Add Rust target
+        run: rustup target add "$TARGET"
+
+      - name: Patch version
+        run: |
+          cd desktop && node scripts/set-version-from-tag.mjs "$VERSION"
+          cd src-tauri && cargo update --workspace
+
+      - name: Write DCM release config overlay
+        run: |
+          printf '{"bundle":{"macOS":{"minimumSystemVersion":"10.15"}}}' \
+            > desktop/src-tauri/tauri.dcm-release.conf.json
+
+      - name: Build sidecars
+        run: |
+          cargo build --release --target "$TARGET" -p buzz-acp -p buzz-agent -p buzz-backend-kubernetes -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli
+          ./scripts/bundle-sidecars.sh "$TARGET"
+
+      - name: Stage Apple notarization API key
+        if: env.SIGN == 'true'
+        env:
+          DCM_APPLE_API_KEY_CONTENT: ${{ secrets.DCM_APPLE_API_KEY_CONTENT }}
+        run: |
+          set -euo pipefail
+          printf '%s' "$DCM_APPLE_API_KEY_CONTENT" | base64 -d > "${RUNNER_TEMP}/apple-api-key.p8"
+
+      - name: Build signed Tauri app
+        if: env.SIGN == 'true'
+        run: cd desktop && pnpm tauri build --verbose --target "$TARGET" --config src-tauri/tauri.dcm-release.conf.json
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.DCM_APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.DCM_APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ secrets.DCM_APPLE_SIGNING_IDENTITY }}
+          APPLE_API_ISSUER: ${{ secrets.DCM_APPLE_API_ISSUER }}
+          APPLE_API_KEY: ${{ secrets.DCM_APPLE_API_KEY }}
+          APPLE_API_KEY_PATH: ${{ runner.temp }}/apple-api-key.p8
+          CMAKE_POLICY_VERSION_MINIMUM: "3.5"
+          MACOSX_DEPLOYMENT_TARGET: "10.15"
+          CMAKE_OSX_DEPLOYMENT_TARGET: "10.15"
+          TAURI_BUNDLER_DMG_IGNORE_CI: "true"
+
+      - name: Build unsigned Tauri app
+        if: env.SIGN != 'true'
+        run: cd desktop && pnpm tauri build --verbose --no-sign --target "$TARGET" --config src-tauri/tauri.dcm-release.conf.json
+        env:
+          CMAKE_POLICY_VERSION_MINIMUM: "3.5"
+          MACOSX_DEPLOYMENT_TARGET: "10.15"
+          CMAKE_OSX_DEPLOYMENT_TARGET: "10.15"
+          TAURI_BUNDLER_DMG_IGNORE_CI: "true"
+
+      - name: Verify code signature
+        if: env.SIGN == 'true'
+        run: |
+          APP_DIR="desktop/src-tauri/target/${TARGET}/release/bundle/macos/Buzz.app"
+          codesign --verify --deep --strict --verbose=2 "$APP_DIR"
+          spctl --assess --type execute --verbose=4 "$APP_DIR"
+          desktop/scripts/verify-macos-entitlements.sh "$APP_DIR"
+
+      - name: Locate and label DMG
+        id: artifacts
+        run: |
+          set -euo pipefail
+          BUNDLE_DIR="desktop/src-tauri/target/${TARGET}/release/bundle"
+          DMG=$(find "$BUNDLE_DIR/dmg" -name '*.dmg' -type f | head -1)
+          if [[ -z "$DMG" ]]; then
+            echo "::error::No DMG found in $BUNDLE_DIR/dmg"
+            exit 1
+          fi
+          RENAMED="$(dirname "$DMG")/Buzz_${VERSION}_x64.dmg"
+          if [[ "$SIGN" != "true" ]]; then
+            # Cosmetic Finder patch repacks the DMG, so it is only safe on
+            # unsigned builds — on signed builds it would invalidate the
+            # signature and notarization ticket Tauri just produced.
+            desktop/scripts/set-dmg-finder-text-size.sh "$DMG" 14
+            RENAMED="$(dirname "$DMG")/Buzz_${VERSION}_x64_unsigned.dmg"
+          fi
+          if [[ "$DMG" != "$RENAMED" ]]; then
+            mv "$DMG" "$RENAMED"
+          fi
+          echo "dmg=$RENAMED" >> "$GITHUB_OUTPUT"
+
+      - name: Stage Intel macOS release artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: dcm-desktop-macos-x64
+          if-no-files-found: error
+          path: ${{ steps.artifacts.outputs.dmg }}
+
+  release-linux:
+    name: Release Linux
+    runs-on: ubuntu-latest
+    # Digest-pinned like the SHA-pinned actions below, matching upstream.
+    container: ubuntu:24.04@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90
+    needs: setup
+    timeout-minutes: 60
+    permissions:
+      contents: read
+    env:
+      VERSION: ${{ needs.setup.outputs.version }}
+      # AppImage tools (linuxdeploy, appimagetool) are themselves AppImages.
+      # Containers lack FUSE, so we must use the extract-and-run fallback.
+      APPIMAGE_EXTRACT_AND_RUN: "1"
+    # This job runs in a container where the default run shell is dash;
+    # the AppImage steps below use bash-only syntax ([[ ]], mapfile, arrays).
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Install system dependencies
+        env:
+          DEBIAN_FRONTEND: noninteractive
+        run: |
+          # Must run first: bare ubuntu:24.04 ships without curl, wget, git, or
+          # ca-certificates. activate-hermit bootstraps via curl+HTTPS (needs
+          # both), and actions/checkout falls back to a REST tarball without git.
+          # Running as root — no sudo needed.
+          apt-get update \
+            -o Acquire::Retries=3 \
+            -o Acquire::http::Timeout=30 \
+            -o Acquire::https::Timeout=30
+          apt-get install -y --no-install-recommends \
+            -o Acquire::Retries=3 \
+            -o Acquire::http::Timeout=30 \
+            -o Acquire::https::Timeout=30 \
+            -o DPkg::Lock::Timeout=120 \
+            build-essential \
+            ca-certificates \
+            curl \
+            desktop-file-utils \
+            file \
+            git \
+            libasound2-dev \
+            libayatana-appindicator3-dev \
+            libgtk-3-dev \
+            librsvg2-dev \
+            libssl-dev \
+            libwebkit2gtk-4.1-dev \
+            libxdo-dev \
+            patchelf \
+            pkg-config \
+            squashfs-tools \
+            wget \
+            xdg-utils
+
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          ref: ${{ needs.setup.outputs.source_sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Mark workspace safe for git (containerized job)
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
+
+      - name: Install appimagetool
+        run: |
+          # Pin to an immutable release tag to avoid supply-chain drift from the
+          # mutable `continuous` tag. Tag: 1.9.1, asset: appimagetool-<arch>.AppImage
+          # (https://github.com/AppImage/appimagetool/releases/tag/1.9.1)
+          case "$(uname -m)" in
+            x86_64)  ARCH_SUFFIX="x86_64" ;;
+            aarch64) ARCH_SUFFIX="aarch64" ;;
+            *)
+              echo "::error::Unsupported architecture: $(uname -m)"
+              exit 1
+              ;;
+          esac
+          wget -q --tries=3 --timeout=30 -O /tmp/appimagetool \
+            "https://github.com/AppImage/appimagetool/releases/download/1.9.1/appimagetool-${ARCH_SUFFIX}.AppImage"
+          # SHA256 integrity check. Refuse to run an unverified binary: if a new
+          # arch (e.g. aarch64) is enabled in CI, compute its hash and add it here.
+          if [[ "$ARCH_SUFFIX" == "x86_64" ]]; then
+            echo "ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0  /tmp/appimagetool" | sha256sum -c
+          else
+            echo "::error::No pinned SHA256 for appimagetool-${ARCH_SUFFIX} — add it before enabling this architecture"
+            exit 1
+          fi
+          install -m 755 /tmp/appimagetool /usr/local/bin/appimagetool
+          # appimagetool otherwise fetches the AppImage type2 runtime from the
+          # MUTABLE `continuous` tag at repack time — the runtime is the first
+          # code users execute, so pin it too. Tag: 20251108, hash is for the
+          # x86_64 asset (non-x86_64 already hard-fails above).
+          # (https://github.com/AppImage/type2-runtime/releases/tag/20251108)
+          wget -q --tries=3 --timeout=30 -O /tmp/appimage-runtime \
+            "https://github.com/AppImage/type2-runtime/releases/download/20251108/runtime-${ARCH_SUFFIX}"
+          echo "2fca8b443c92510f1483a883f60061ad09b46b978b2631c807cd873a47ec260d  /tmp/appimage-runtime" | sha256sum -c
+          install -D -m 644 /tmp/appimage-runtime /usr/local/lib/appimage-runtime
+          echo "APPIMAGETOOL_RUNTIME_FILE=/usr/local/lib/appimage-runtime" >> "$GITHUB_ENV"
+
+      - name: Install desktop dependencies
+        run: just desktop-install-ci
+
+      - name: Patch version
+        run: |
+          cd desktop && node scripts/set-version-from-tag.mjs "$VERSION"
+          cd src-tauri && cargo update --workspace
+
+      - name: Build sidecars
+        run: |
+          cargo build --release -p buzz-acp -p buzz-agent -p buzz-backend-kubernetes -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli
+          ./scripts/bundle-sidecars.sh
+
+      - name: Build Linux Tauri app
+        run: cd desktop && pnpm tauri build --verbose --ci --bundles deb,appimage
+        env:
+          CMAKE_POLICY_VERSION_MINIMUM: "3.5"
+
+      - name: Fix AppImage (remove infra libs, shim host GStreamer)
+        run: |
+          mapfile -t APPIMAGES < <(find desktop/src-tauri/target/release/bundle/appimage -name '*.AppImage' -type f)
+          if [[ ${#APPIMAGES[@]} -eq 0 ]]; then
+            echo "::error::No AppImage found to post-process"
+            exit 1
+          fi
+          if [[ ${#APPIMAGES[@]} -gt 1 ]]; then
+            echo "::error::Expected exactly one AppImage, found ${#APPIMAGES[@]}: ${APPIMAGES[*]}"
+            exit 1
+          fi
+          bash desktop/scripts/fix-appimage.sh "${APPIMAGES[0]}"
+
+      - name: Locate Linux build artifacts
+        id: linux-artifacts
+        run: |
+          BUNDLE_DIR="desktop/src-tauri/target/release/bundle"
+
+          DEB=$(find "$BUNDLE_DIR/deb" -name '*.deb' -type f | head -1)
+          if [[ -z "$DEB" ]]; then
+            echo "::error::No DEB found in $BUNDLE_DIR/deb"
+            exit 1
+          fi
+          echo "deb=$DEB" >> "$GITHUB_OUTPUT"
+
+          APPIMAGE=$(find "$BUNDLE_DIR/appimage" -name '*.AppImage' -type f | head -1)
+          if [[ -z "$APPIMAGE" ]]; then
+            echo "::error::No AppImage found in $BUNDLE_DIR/appimage"
+            exit 1
+          fi
+          echo "appimage=$APPIMAGE" >> "$GITHUB_OUTPUT"
+
+      - name: Stage Linux release artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: dcm-desktop-linux-x64
+          if-no-files-found: error
+          path: |
+            ${{ steps.linux-artifacts.outputs.deb }}
+            ${{ steps.linux-artifacts.outputs.appimage }}
+
+  release-windows:
+    name: Release Windows
+    runs-on: windows-latest
+    needs: setup
+    timeout-minutes: 60
+    permissions:
+      contents: read
+    env:
+      VERSION: ${{ needs.setup.outputs.version }}
+      TARGET: x86_64-pc-windows-msvc
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          ref: ${{ needs.setup.outputs.source_sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
+        with:
+          targets: ${{ env.TARGET }}
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 24.14.1
+          # Disable dependency caching: a writable cache in this release
+          # workflow (contents: read, feeds an installer) is a poisoning
+          # vector. pnpm install runs uncached below.
+          package-manager-cache: false
+
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
+        with:
+          version: 11.4.0
+
+      - name: Install desktop dependencies
+        shell: bash
+        run: pnpm install --frozen-lockfile
+
+      - name: Patch version
+        shell: bash
+        run: |
+          cd desktop && node scripts/set-version-from-tag.mjs "$VERSION"
+          cd src-tauri && cargo update --workspace
+
+      - name: Build sidecars
+        shell: bash
+        run: |
+          cargo build --release --target "$TARGET" -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli
+          ./scripts/bundle-sidecars.sh "$TARGET"
+
+      - name: Build Windows NSIS installer (unsigned)
+        shell: bash
+        run: cd desktop && pnpm tauri build --verbose --target "$TARGET" --bundles nsis
+        env:
+          CMAKE_POLICY_VERSION_MINIMUM: "3.5"
+
+      - name: Locate Windows build artifacts
+        id: artifacts
+        shell: bash
+        run: |
+          BUNDLE_DIR="desktop/src-tauri/target/${TARGET}/release/bundle"
+
+          EXE=$(find "$BUNDLE_DIR/nsis" -name '*.exe' -type f | head -1)
+          if [[ -z "$EXE" ]]; then
+            echo "::error::No NSIS installer found in $BUNDLE_DIR/nsis"
+            exit 1
+          fi
+
+          # Label unsigned like the upstream OSS lane so nobody mistakes it
+          # for an Authenticode-signed installer.
+          EXE_DIR=$(dirname "$EXE")
+          EXE_BASE=$(basename "$EXE" .exe)
+          MARKED_EXE="${EXE_DIR}/${EXE_BASE}_unsigned.exe"
+          mv "$EXE" "$MARKED_EXE"
+          echo "exe=$MARKED_EXE" >> "$GITHUB_OUTPUT"
+
+      - name: Stage Windows release artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: dcm-desktop-windows-x64
+          if-no-files-found: error
+          path: ${{ steps.artifacts.outputs.exe }}
+
+  publish:
+    name: Publish GitHub Release
+    runs-on: ubuntu-latest
+    needs: [setup, release-macos-arm64, release-macos-x64, release-linux, release-windows]
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    env:
+      VERSION: ${{ needs.setup.outputs.version }}
+      SOURCE_SHA: ${{ needs.setup.outputs.source_sha }}
+      SIGN: ${{ needs.setup.outputs.sign }}
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: Re-verify tag binding before publishing
+        run: |
+          set -euo pipefail
+          # The builds run from the SHA captured at setup. If the tag was
+          # moved while they ran, refuse to publish artifacts under a tag
+          # that no longer points at the source they were built from.
+          REMOTE_SHA=$(git ls-remote "https://github.com/${GITHUB_REPOSITORY}.git" \
+            "refs/tags/dcm-desktop-v${VERSION}^{}" "refs/tags/dcm-desktop-v${VERSION}" \
+            | awk '{print $1}' | head -1)
+          if [[ -z "$REMOTE_SHA" ]]; then
+            echo "::error::Tag dcm-desktop-v${VERSION} no longer exists on the remote"
+            exit 1
+          fi
+          if [[ "$REMOTE_SHA" != "$SOURCE_SHA" ]]; then
+            echo "::error::Tag dcm-desktop-v${VERSION} now points at $REMOTE_SHA, but artifacts were built from $SOURCE_SHA. Refusing to publish."
+            exit 1
+          fi
+
+      - name: Download staged release artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: dcm-desktop-*
+          path: staged-by-platform
+
+      - name: Flatten staged artifacts without basename collisions
+        run: |
+          set -euo pipefail
+          mkdir staged
+          while IFS= read -r -d '' file; do
+            name="$(basename "$file")"
+            [[ ! -e "staged/$name" ]] || {
+              echo "::error::release artifact basename collision: $name"
+              exit 1
+            }
+            cp "$file" "staged/$name"
+          done < <(find staged-by-platform -type f -print0)
+          ls -la staged
+
+      - name: Write release notes
+        run: |
+          set -euo pipefail
+          {
+            echo "DCM Buzz Desktop v${VERSION}"
+            echo
+            echo "- Source: \`${SOURCE_SHA}\` (dcm-production history)"
+            echo "- Built by: DCM Desktop Release workflow run ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+            if [[ "$SIGN" == "true" ]]; then
+              echo "- macOS: signed with Developer ID and notarized by Apple"
+            else
+              echo "- macOS: **UNSIGNED** build (Apple signing secrets not configured). To open: right-click the app > Open, or run \`xattr -dr com.apple.quarantine /Applications/Buzz.app\` after install."
+            fi
+            echo "- Windows: unsigned NSIS installer (expect a SmartScreen warning)"
+            echo "- Linux: unsigned .deb and .AppImage"
+            echo "- No auto-updater: install new versions manually from Releases"
+          } > release-notes.md
+          cat release-notes.md
+
+      - name: Create or verify versioned draft
+        run: |
+          set -euo pipefail
+          PRERELEASE_FLAGS=()
+          if [[ "$VERSION" == *-* ]]; then
+            PRERELEASE_FLAGS=(--prerelease --latest=false)
+          fi
+          if gh release view "dcm-desktop-v${VERSION}" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            EXISTING_SHA=$(gh release view "dcm-desktop-v${VERSION}" --repo "$GITHUB_REPOSITORY" --json targetCommitish --jq .targetCommitish)
+            IS_DRAFT=$(gh release view "dcm-desktop-v${VERSION}" --repo "$GITHUB_REPOSITORY" --json isDraft --jq .isDraft)
+            [[ "$EXISTING_SHA" == "$SOURCE_SHA" ]] || {
+              echo "::error::existing release targets $EXISTING_SHA, not the tag-bound source $SOURCE_SHA"; exit 1;
+            }
+            if [[ "$IS_DRAFT" != true ]]; then
+              echo "already_published=true" >> "$GITHUB_ENV"
+            fi
+          else
+            gh release create "dcm-desktop-v${VERSION}" \
+              --repo "$GITHUB_REPOSITORY" \
+              --draft \
+              --target "$SOURCE_SHA" \
+              --title "DCM Buzz Desktop v${VERSION}" \
+              --notes-file release-notes.md \
+              "${PRERELEASE_FLAGS[@]}"
+          fi
+
+      - name: Upload complete artifact set to versioned draft
+        if: env.already_published != 'true'
+        run: |
+          set -euo pipefail
+          mapfile -t files < <(find staged -type f -print)
+          [[ "${#files[@]}" -gt 0 ]] || { echo "::error::no staged release artifacts"; exit 1; }
+          gh release upload "dcm-desktop-v${VERSION}" --repo "$GITHUB_REPOSITORY" "${files[@]}" --clobber
+
+      - name: Publish complete versioned release
+        if: env.already_published != 'true'
+        run: gh release edit "dcm-desktop-v${VERSION}" --repo "$GITHUB_REPOSITORY" --draft=false
diff --git a/docs/DCM_DESKTOP_RELEASES.md b/docs/DCM_DESKTOP_RELEASES.md
new file mode 100644
index 00000000000..49820b1f4f0
--- /dev/null
+++ b/docs/DCM_DESKTOP_RELEASES.md
@@ -0,0 +1,127 @@
+# DCM Desktop Releases
+
+How Divine Creative Ministries builds and distributes the customized Buzz
+desktop app (macOS, Windows, Linux) from the fork. This is the desktop
+counterpart to [DCM_PRODUCTION_DEPLOYMENT.md](DCM_PRODUCTION_DEPLOYMENT.md):
+the VPS deploy ships only the relay image — desktop UI changes reach users
+only through the releases described here.
+
+The lane is implemented by
+[`.github/workflows/dcm-desktop-release.yml`](../.github/workflows/dcm-desktop-release.yml),
+a DCM-only addition. The upstream release lane (`release.yml`) is gated to
+`block/buzz` and depends on Block's internal signing infrastructure; it is
+intentionally untouched.
+
+## Cutting a release
+
+Releases are cut by pushing a `dcm-desktop-v<semver>` tag that points into
+reviewed `dcm-production` history (the workflow hard-fails otherwise):
+
+```bash
+git fetch origin dcm-production
+git tag dcm-desktop-v0.1.0 origin/dcm-production
+git push origin dcm-desktop-v0.1.0
+```
+
+The workflow then builds four artifact sets and publishes a GitHub Release
+named `dcm-desktop-v<version>` on the fork:
+
+| Platform | Artifact | Signed? |
+|----------|----------|---------|
+| macOS Apple Silicon | `Buzz_<version>_aarch64.dmg` (with `--features mesh-llm`, matching upstream) | Yes, when Apple secrets are configured; `_unsigned` suffix otherwise |
+| macOS Intel | `Buzz_<version>_x64.dmg` | Same as above |
+| Windows x64 | NSIS `*_unsigned.exe` installer | No (matches upstream OSS lane) |
+| Linux x64 | `.deb` + `.AppImage` | No signing required |
+
+Versions containing a `-` suffix (e.g. `0.1.0-beta.1`) publish as prereleases.
+
+**No auto-updater.** The Tauri updater endpoints stay empty, so installed
+apps never self-update; each release is installed manually from the Releases
+page. Wiring the updater (endpoint + Tauri signing keypair + `latest.json`)
+is a possible follow-up, documented at the bottom.
+
+## macOS signing setup (owner runbook)
+
+Until these secrets exist, macOS builds are produced **unsigned** with an
+`_unsigned` filename suffix. Unsigned apps trigger Gatekeeper: open via
+right-click → Open, or `xattr -dr com.apple.quarantine /Applications/Buzz.app`.
+
+Signing requires an active [Apple Developer Program](https://developer.apple.com)
+membership. Two credentials are needed: a **Developer ID Application
+certificate** (signs the app) and an **App Store Connect API key**
+(notarizes it). This is a different certificate type from the iOS
+Private Custom App path in
+[DIVINE_CREATIVE_FORK_WORKFLOW.md](DIVINE_CREATIVE_FORK_WORKFLOW.md) — the
+same Apple account issues both.
+
+### 1. Developer ID Application certificate
+
+1. On a Mac, open **Keychain Access → Certificate Assistant → Request a
+   Certificate From a Certificate Authority…** Enter the Apple ID email,
+   leave CA Email empty, select **Saved to disk**. This saves a `.certSigningRequest`.
+2. At [developer.apple.com/account/resources/certificates](https://developer.apple.com/account/resources/certificates/list)
+   click **+**, choose **Developer ID Application**, upload the CSR, and
+   download the resulting `.cer`.
+3. Double-click the `.cer` to install it into the login keychain (it pairs
+   with the private key created in step 1).
+4. In Keychain Access, find the certificate ("Developer ID Application:
+   <Name> (<TEAMID>)"), expand it to confirm the private key is attached,
+   then right-click → **Export** both as a single `.p12`, choosing a strong
+   export password.
+
+### 2. App Store Connect API key (for notarization)
+
+1. At [App Store Connect → Users and Access → Integrations → App Store Connect API](https://appstoreconnect.apple.com/access/integrations/api)
+   click **+** to generate a **Team key** with the **Developer** role.
+2. Record the **Issuer ID** (UUID at the top of the page) and the **Key ID**.
+3. Download the `.p8` key file (downloadable only once).
+
+### 3. Add the six repository secrets
+
+From a terminal on the machine holding the files:
+
+```bash
+REPO=Divine-Creative-Ministries/buzz
+
+base64 -i DeveloperID.p12 | gh secret set DCM_APPLE_CERTIFICATE --repo "$REPO"
+gh secret set DCM_APPLE_CERTIFICATE_PASSWORD --repo "$REPO"   # paste the .p12 export password
+gh secret set DCM_APPLE_SIGNING_IDENTITY --repo "$REPO" \
+  --body "Developer ID Application: <Name> (<TEAMID>)"        # exact certificate common name
+gh secret set DCM_APPLE_API_ISSUER --repo "$REPO"             # paste the Issuer ID
+gh secret set DCM_APPLE_API_KEY --repo "$REPO"                # paste the Key ID
+base64 -i AuthKey_<KEYID>.p8 | gh secret set DCM_APPLE_API_KEY_CONTENT --repo "$REPO"
+```
+
+Then delete the local `.p12` and `.p8` copies (or move them to secure
+offline storage). Never commit them.
+
+The workflow validates the set: if `DCM_APPLE_CERTIFICATE` exists but any of
+the other five is missing, the release fails fast in setup instead of
+producing a half-signed build. The next `dcm-desktop-v*` tag after the
+secrets exist produces signed, notarized DMGs automatically — no workflow
+change needed.
+
+## Security properties
+
+- The workflow runs only on `Divine-Creative-Ministries/buzz` and only for
+  tags whose commit is an ancestor of `dcm-production` — release binaries
+  can only be built from reviewed history. The publish job re-checks that
+  the tag still points at the SHA the artifacts were built from, so a tag
+  moved mid-run cannot relabel binaries. Recommended hardening: add a
+  repository ruleset protecting `refs/tags/dcm-desktop-v*` from update and
+  deletion.
+- All third-party actions are SHA-pinned and the Linux container image,
+  appimagetool, and AppImage runtime are digest/hash-pinned (inherited from
+  the upstream lane).
+- Build jobs run with `contents: read`; only the final publish job has
+  `contents: write`, and it only creates/edits the `dcm-desktop-v*` release.
+- Secrets never appear in artifacts; the notarization key is written to the
+  runner temp directory only for the signed build step.
+
+## Possible follow-ups (not in scope today)
+
+- **Auto-updates:** generate a Tauri updater keypair, add the public key +
+  a fork-hosted `latest.json` endpoint via `desktop/scripts/build-release-config.mjs`,
+  and re-enable `createUpdaterArtifacts` — mirroring the upstream lane.
+- **Windows Authenticode signing** to remove the SmartScreen warning.
+- **`buzz-desktop-latest` rolling release** pointer like upstream's.