diff --git a/.gitignore b/.gitignore
index cfa6940..1b715be 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 /target
 CLAUDE.md
+docs/
diff --git a/README.md b/README.md
index 601adaa..d67cf10 100644
--- a/README.md
+++ b/README.md
@@ -84,7 +84,7 @@ Query → Overrides → .numa TLD → Blocklist → Local Zones → Cache → Up
 
 No DNS libraries. The wire protocol — headers, labels, compression pointers, record types — is parsed and serialized by hand. Runs on `tokio` + `axum`, async per-query task spawning.
 
-[Full API reference (22 endpoints)](docs/development-plan.md) · [Configuration reference](numa.toml)
+[Configuration reference](numa.toml)
 
 ## Roadmap
 
diff --git a/install.sh b/install.sh
index 3771907..a388659 100755
--- a/install.sh
+++ b/install.sh
@@ -58,6 +58,12 @@ else
 fi
 
 chmod +x "$INSTALL_DIR/numa"
+
+# macOS: ad-hoc codesign (required or the binary gets killed)
+if [ "$OS_NAME" = "macos" ]; then
+  codesign -f -s - "$INSTALL_DIR/numa" 2>/dev/null || true
+fi
+
 rm -rf "$TMP"
 
 echo ""