diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 66f612fb..b33503ef 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -64,7 +64,7 @@ jobs:
       matrix:
         include:
           ${{ (github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v'))
-          && fromJSON('[{"name":"ubuntu-latest","os":"opencodex","runner":"[\"self-hosted\",\"Linux\",\"X64\",\"jan\"]","run_tests":true,"run_quality":true,"run_typecheck":true,"shard_index":0,"shard_count":2},{"name":"ubuntu-latest shard 2/2","os":"opencodex","runner":"[\"self-hosted\",\"Linux\",\"X64\",\"jan\"]","run_tests":true,"run_quality":false,"run_typecheck":false,"shard_index":1,"shard_count":2},{"name":"macos-latest","os":"macos-latest","runner":"\"macos-latest\"","run_tests":true,"run_quality":false,"run_typecheck":true,"shard_index":0,"shard_count":1},{"name":"macos-quality","os":"macos-latest","runner":"\"macos-latest\"","run_tests":false,"run_quality":true,"run_typecheck":false,"shard_index":0,"shard_count":1},{"name":"windows-latest","os":"windows-latest","runner":"\"windows-latest\"","run_tests":true,"run_quality":false,"run_typecheck":true,"shard_index":0,"shard_count":2},{"name":"windows-latest shard 2/2","os":"windows-latest","runner":"\"windows-latest\"","run_tests":true,"run_quality":false,"run_typecheck":false,"shard_index":1,"shard_count":2},{"name":"windows-quality","os":"windows-latest","runner":"\"windows-latest\"","run_tests":false,"run_quality":true,"run_typecheck":false,"shard_index":0,"shard_count":1}]')
+          && fromJSON('[{"name":"ubuntu-latest","os":"opencodex","runner":"[\"self-hosted\",\"Linux\",\"X64\",\"jan\"]","run_tests":true,"run_quality":true,"run_typecheck":true,"shard_index":0,"shard_count":2},{"name":"ubuntu-latest shard 2/2","os":"opencodex","runner":"[\"self-hosted\",\"Linux\",\"X64\",\"jan\"]","run_tests":true,"run_quality":false,"run_typecheck":false,"shard_index":1,"shard_count":2},{"name":"windows-latest","os":"windows-latest","runner":"\"windows-latest\"","run_tests":true,"run_quality":false,"run_typecheck":true,"shard_index":0,"shard_count":2},{"name":"windows-latest shard 2/2","os":"windows-latest","runner":"\"windows-latest\"","run_tests":true,"run_quality":false,"run_typecheck":false,"shard_index":1,"shard_count":2},{"name":"windows-quality","os":"windows-latest","runner":"\"windows-latest\"","run_tests":false,"run_quality":true,"run_typecheck":false,"shard_index":0,"shard_count":1}]')
           || fromJSON('[{"name":"ubuntu-latest","os":"opencodex","runner":"[\"self-hosted\",\"Linux\",\"X64\",\"jan\"]","run_tests":true,"run_quality":true,"run_typecheck":true,"shard_index":0,"shard_count":2},{"name":"ubuntu-latest shard 2/2","os":"opencodex","runner":"[\"self-hosted\",\"Linux\",\"X64\",\"jan\"]","run_tests":true,"run_quality":false,"run_typecheck":false,"shard_index":1,"shard_count":2}]') }}
     steps:
       - name: Checkout
@@ -175,7 +175,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        include: ${{ (github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')) && fromJSON('[{"platform":"opencodex","runner":"[\"self-hosted\",\"Linux\",\"X64\",\"jan\"]"},{"platform":"windows-latest","runner":"\"windows-latest\""},{"platform":"macos-latest","runner":"\"macos-latest\""}]') || fromJSON('[{"platform":"opencodex","runner":"[\"self-hosted\",\"Linux\",\"X64\",\"jan\"]"}]') }}
+        include: ${{ (github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')) && fromJSON('[{"platform":"opencodex","runner":"[\"self-hosted\",\"Linux\",\"X64\",\"jan\"]"},{"platform":"windows-latest","runner":"\"windows-latest\""}]') || fromJSON('[{"platform":"opencodex","runner":"[\"self-hosted\",\"Linux\",\"X64\",\"jan\"]"}]') }}
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
diff --git a/.github/workflows/container.yml b/.github/workflows/container.yml
index 18f9522f..8bc13367 100644
--- a/.github/workflows/container.yml
+++ b/.github/workflows/container.yml
@@ -158,7 +158,7 @@ jobs:
           fi
           # shellcheck disable=SC2016 # $run/$passed/$name are jq bindings, not shell variables.
           matrix_ok="$(gh run view "$ci_id" --json headSha,conclusion,jobs --jq \
-            '. as $run | [.jobs[] | select(.conclusion == "success") | .name] as $passed | ($run.conclusion == "success" and (["ubuntu-latest", "ubuntu-latest shard 2/2", "macos-latest", "macos-quality", "windows-latest", "windows-latest shard 2/2", "windows-quality", "npm-global opencodex", "npm-global macos-latest", "npm-global windows-latest", "Security audit", "Lint GitHub Actions"] | all(.[]; . as $name | $passed | index($name) != null)))')"
+            '. as $run | [.jobs[] | select(.conclusion == "success") | .name] as $passed | ($run.conclusion == "success" and (["ubuntu-latest", "ubuntu-latest shard 2/2", "windows-latest", "windows-latest shard 2/2", "windows-quality", "npm-global opencodex", "npm-global windows-latest", "Security audit", "Lint GitHub Actions"] | all(.[]; . as $name | $passed | index($name) != null)))')"
           if [ "$matrix_ok" != "true" ]; then
             echo "::error::CI run ${ci_id} lacks successful required platform jobs"
             exit 1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 670553e7..d46ebeb1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -187,7 +187,7 @@ jobs:
           fi
           # shellcheck disable=SC2016 # $run/$passed/$name are jq bindings, not shell variables.
           matrix_ok="$(gh run view "$ci_id" --json headSha,conclusion,jobs --jq \
-            '. as $run | [.jobs[] | select(.conclusion == "success") | .name] as $passed | ($run.conclusion == "success" and (["ubuntu-latest", "ubuntu-latest shard 2/2", "macos-latest", "macos-quality", "windows-latest", "windows-latest shard 2/2", "windows-quality", "npm-global opencodex", "npm-global macos-latest", "npm-global windows-latest", "Security audit", "Lint GitHub Actions"] | all(.[]; . as $name | $passed | index($name) != null)))')"
+            '. as $run | [.jobs[] | select(.conclusion == "success") | .name] as $passed | ($run.conclusion == "success" and (["ubuntu-latest", "ubuntu-latest shard 2/2", "windows-latest", "windows-latest shard 2/2", "windows-quality", "npm-global opencodex", "npm-global windows-latest", "Security audit", "Lint GitHub Actions"] | all(.[]; . as $name | $passed | index($name) != null)))')"
           if [ "$matrix_ok" != "true" ]; then
             echo "::error::CI run ${ci_id} lacks successful required platform jobs"
             exit 1
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 66cbf97a..6be72338 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -53,5 +53,5 @@ bun run setup:hooks
 
 **Pre-push** runs `bun run prepush` — `typecheck`, `lint:gui`, `test`, `privacy:scan`,
 and `doctor:gui:if-changed` — before every `git push`. The same checks run on
-ubuntu-latest, macos-latest, and windows-latest in CI (CI additionally builds the GUI
+ubuntu-latest and windows-latest in CI (CI additionally builds the GUI
 and smoke-tests the CLI). Skip in an emergency with `git push --no-verify`.
diff --git a/tests/ci-workflows.test.ts b/tests/ci-workflows.test.ts
index 677119b2..dca57c9d 100644
--- a/tests/ci-workflows.test.ts
+++ b/tests/ci-workflows.test.ts
@@ -87,13 +87,10 @@ describe("GitHub Actions hardening", () => {
     for (const job of [
       "ubuntu-latest",
       "ubuntu-latest shard 2/2",
-      "macos-latest",
-      "macos-quality",
       "windows-latest",
       "windows-latest shard 2/2",
       "windows-quality",
       "npm-global opencodex",
-      "npm-global macos-latest",
       "npm-global windows-latest",
       "Security audit",
       "Lint GitHub Actions",