diff --git a/.github/workflows/promotion-gate.yml b/.github/workflows/promotion-gate.yml
index 6717441..89b4f84 100644
--- a/.github/workflows/promotion-gate.yml
+++ b/.github/workflows/promotion-gate.yml
@@ -79,24 +79,32 @@ jobs:
           DMG=$(ls release-assets/*macos*.dmg 2>/dev/null | head -1)
           [ -f "$DMG" ] || { echo "no macOS DMG in release; skipping plist gate"; exit 0; }
           sudo apt-get update -qq
-          sudo apt-get install -y -qq p7zip-full libplist-utils
+          sudo apt-get install -y -qq p7zip-full
           # Pick whichever 7-Zip CLI got installed.
           SEVENZ=""
           for cand in 7z 7zz 7za; do
             if command -v "$cand" >/dev/null 2>&1; then SEVENZ="$cand"; break; fi
           done
-          [ -n "$SEVENZ" ] || { echo "::error::no 7z-family binary found after installing p7zip-full"; exit 1; }
+          [ -n "$SEVENZ" ] || { echo "::error::no 7z-family binary found"; exit 1; }
           echo "using 7z CLI: $SEVENZ"
           mkdir -p release-assets/dmg-extract
           "$SEVENZ" x -o./release-assets/dmg-extract -y "$DMG" > /dev/null
           PLIST=$(find release-assets/dmg-extract -name Info.plist -path "*BearBrowser.app/Contents/*" | head -1)
           [ -f "$PLIST" ] || { echo "::error::no Info.plist in DMG"; find release-assets/dmg-extract -maxdepth 4 -type d | head -20; exit 1; }
-          # Convert to XML if binary (plistutil handles both formats).
-          plistutil -i "$PLIST" -o /tmp/plist.xml 2>/dev/null || cp "$PLIST" /tmp/plist.xml
-          VERSION=$(grep -A1 CFBundleShortVersionString /tmp/plist.xml | tail -1 | sed -E 's,.*<string>(.*)</string>.*,\1,')
+          # Read the plist with Python's plistlib — handles BOTH binary and XML
+          # formats, always available. Prior attempt piped grep|sed against
+          # plistutil output; plistutil silently failed (its `2>/dev/null`
+          # swallowed the error) and grep matched the binary blob but sed
+          # extracted nothing. Second promotion-gate false-negative in a row.
+          VERSION=$(python3 -c "
+          import plistlib, sys
+          with open(sys.argv[1], 'rb') as f: d = plistlib.load(f)
+          print(d.get('CFBundleShortVersionString',''))
+          " "$PLIST")
           EXPECTED="${TAG#v}"
-          echo "plist CFBundleShortVersionString: $VERSION"
-          echo "release tag (without leading v):  $EXPECTED"
+          echo "plist CFBundleShortVersionString: '$VERSION'"
+          echo "release tag (without leading v):  '$EXPECTED'"
+          [ -n "$VERSION" ] || { echo "::error::plistlib returned empty version"; exit 1; }
           [ "$VERSION" = "$EXPECTED" ] || { echo "::error::plist version $VERSION != tag $EXPECTED"; exit 1; }
 
       - name: Update-check network hygiene smoke