diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 37ec0b257..945be27b0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -68,12 +68,13 @@ jobs:
       # Cross-build every GoReleaser release target with the release
       # build tags, using build-tags.txt the same way third-party
       # packagers do. (A test keeps that file in sync with
-      # internal/buildtags.ReleaseTags; darwin builds are covered by
-      # the macOS test job, whose e2e tests build a tagged binary.)
+      # internal/buildtags.ReleaseTags.
       - name: cross-build cmd/tailcat with release build tags
         run: |
           tags=$(cat build-tags.txt)
           echo "release tags: $tags"
+          GOOS=darwin  GOARCH=amd64         go build -o /dev/null -tags "$tags" ./cmd/tailcat
+          GOOS=darwin  GOARCH=arm64         go build -o /dev/null -tags "$tags" ./cmd/tailcat
           GOOS=linux   GOARCH=amd64         go build -o /dev/null -tags "$tags" ./cmd/tailcat
           GOOS=linux   GOARCH=arm64         go build -o /dev/null -tags "$tags" ./cmd/tailcat
           GOOS=linux   GOARCH=arm  GOARM=7  go build -o /dev/null -tags "$tags" ./cmd/tailcat
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index bbf2cc537..3503f5367 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -16,6 +16,7 @@ builds:
     flags:
       - -tags=ts_omit_ace,ts_omit_acme,ts_omit_advertiseexitnode,ts_omit_advertiseroutes,ts_omit_appconnectors,ts_omit_aws,ts_omit_bird,ts_omit_cachenetmap,ts_omit_captiveportal,ts_omit_capture,ts_omit_cliconndiag,ts_omit_clientmetrics,ts_omit_clientupdate,ts_omit_cloud,ts_omit_colorable,ts_omit_completion,ts_omit_completion_scripts,ts_omit_conn25,ts_omit_connreject,ts_omit_debug,ts_omit_debugeventbus,ts_omit_debugportmapper,ts_omit_desktop_sessions,ts_omit_dns,ts_omit_dnsresolvecache,ts_omit_doctor,ts_omit_drive,ts_omit_favorites,ts_omit_flashappliance,ts_omit_health,ts_omit_hujsonconf,ts_omit_identityfederation,ts_omit_ipnbus,ts_omit_iptables,ts_omit_kube,ts_omit_linkspeed,ts_omit_linuxdnsfight,ts_omit_listenrawdisco,ts_omit_logtail,ts_omit_netlog,ts_omit_networkmanager,ts_omit_oauthkey,ts_omit_osrouter,ts_omit_outboundproxy,ts_omit_peerapiclient,ts_omit_peerapiserver,ts_omit_portlist,ts_omit_portmapper,ts_omit_posture,ts_omit_qrcodes,ts_omit_relayserver,ts_omit_remoteconfig,ts_omit_resolved,ts_omit_routecheck,ts_omit_runtimemetrics,ts_omit_sdnotify,ts_omit_serve,ts_omit_serviceclientprefs,ts_omit_synology,ts_omit_syslog,ts_omit_syspolicy,ts_omit_systray,ts_omit_taildrop,ts_omit_tailnetlock,ts_omit_tap,ts_omit_tpm,ts_omit_tundevstats,ts_omit_unixsocketidentity,ts_omit_useexitnode,ts_omit_useproxy,ts_omit_usermetrics,ts_omit_useroutes,ts_omit_wakeonlan,ts_omit_webbrowser,ts_omit_webclient
     goos:
+      - darwin
       - linux
       - windows
     goarch:
@@ -25,6 +26,8 @@ builds:
     goarm:
       - "7"
     ignore:
+      - goos: darwin
+        goarch: arm
       - goos: windows
         goarch: arm
 
diff --git a/INSTALL.md b/INSTALL.md
index fc98e2b07..b1bd5b3d9 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -8,8 +8,8 @@ tailcat is and how to use it, see the [README](./README.md).
 Prebuilt binaries are on the
 [Releases page](https://github.com/tailscale/tailcat/releases): static
 Linux binaries (tar.gz) plus Debian (.deb) and RPM (.rpm) packages for
-amd64, arm64, and armv7, and Windows binaries (zip) for amd64 and
-arm64.
+amd64, arm64, and armv7; macOS binaries (tar.gz) for amd64 and arm64;
+and Windows binaries (zip) for amd64 and arm64.
 
 ## Homebrew (macOS)
 
diff --git a/RELEASING.md b/RELEASING.md
index 06513b4e9..b5dfecd94 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -40,6 +40,7 @@ Each release contains:
 * Linux static binaries (tar.gz) for amd64, arm64, and armv7
 * Debian (.deb) and RPM (.rpm) packages for the same architectures
 * Windows binaries (zip) for amd64 and arm64
+* macOS binaries (tar.gz) for amd64 and arm64
 * `checksums.txt` with SHA-256 checksums of the above
 
 Each release also pushes container images (amd64 and arm64) to