diff --git a/scripts/ci/_common.sh b/scripts/ci/_common.sh
index bbf76b12..076ffbea 100755
--- a/scripts/ci/_common.sh
+++ b/scripts/ci/_common.sh
@@ -495,6 +495,15 @@ use_xcode_toolchain() {
   done < <(env)
 
   configure_reproducible_native_paths
+
+  export SDKROOT="${SDKROOT:-${macos_sdkroot}}"
+  export CMAKE_OSX_SYSROOT="${CMAKE_OSX_SYSROOT:-${macos_sdkroot}}"
+  for name in \
+    CFLAGS CXXFLAGS OBJCFLAGS OBJCXXFLAGS \
+    CFLAGS_aarch64_apple_darwin CXXFLAGS_aarch64_apple_darwin \
+    CFLAGS_x86_64_apple_darwin CXXFLAGS_x86_64_apple_darwin; do
+    append_env_words_once "${name}" "-isysroot ${macos_sdkroot}"
+  done
 }
 
 require_ios_simulator_runtime_for_xcode() {
diff --git a/scripts/ci/canonical-windows-nsis-payload-hash.py b/scripts/ci/canonical-windows-nsis-payload-hash.py
index 6bc5db88..8785ba43 100644
--- a/scripts/ci/canonical-windows-nsis-payload-hash.py
+++ b/scripts/ci/canonical-windows-nsis-payload-hash.py
@@ -19,6 +19,11 @@
     "VCRUNTIME140.dll",
     "VCRUNTIME140_1.dll",
 )
+GENERATED_NSIS_PAYLOAD_FILES = frozenset(
+    {
+        "uninstall.exe",
+    }
+)
 
 
 def sha256_bytes(data):
@@ -149,6 +154,11 @@ def canonical_tree_entries(root):
         for name in sorted(files):
             path = os.path.join(current_root, name)
             rel = os.path.relpath(path, root).replace(os.sep, "/")
+            # makensis generates uninstall.exe from a temporary helper during
+            # packaging and signs that helper in signed builds. It is not part
+            # of Maple's reproducible app/runtime payload.
+            if rel.lower() in GENERATED_NSIS_PAYLOAD_FILES:
+                continue
             with open(path, "rb") as f:
                 canonical = canonical_pe_bytes(f.read(), rel)
             entries.append((rel, len(canonical), sha256_bytes(canonical)))
diff --git a/scripts/ci/release-verification-guide.sh b/scripts/ci/release-verification-guide.sh
index 845f8ccb..fb8730ea 100755
--- a/scripts/ci/release-verification-guide.sh
+++ b/scripts/ci/release-verification-guide.sh
@@ -58,7 +58,7 @@ This guide was generated by release CI after Maple's release artifact verifier p
 
 ## What The Proofs Cover
 
-The release contains final SHA-256 manifests, canonical payload manifests, Tauri updater signatures, and GitHub artifact attestations. Together they let you check that downloaded bytes match the release, that updater signatures match \`latest.json\`, and that signed Android, macOS, and iOS payloads strip back to the reproducible unsigned build products where that platform supports the check. Windows release proofs cover the final Authenticode-signed NSIS installer, its final Tauri updater signature, and the pinned app-local runtime DLLs used during bundling. Windows verification does not yet canonicalize Authenticode-signed binaries back to an unsigned baseline.
+The release contains final SHA-256 manifests, canonical payload manifests, Tauri updater signatures, and GitHub artifact attestations. Together they let you check that downloaded bytes match the release, that updater signatures match \`latest.json\`, and that signed Android, macOS, and iOS payloads strip back to the reproducible unsigned build products where that platform supports the check. Windows release proofs cover the final Authenticode-signed NSIS installer, its final Tauri updater signature, the pinned app-local runtime DLLs used during bundling, and the signed installer's canonical app/runtime payload after excluding the NSIS-generated uninstaller helper.
 
 GitHub attestations prove that release CI produced the published bytes for this tag. The Maple verifier then recomputes the local hashes and canonical payload proofs from the files you downloaded.
 
@@ -106,7 +106,8 @@ nix develop .#desktop-linux -c ./scripts/ci/verify-release-artifacts.sh artifact
 nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts macos
 
 # Windows desktop installer: verifies final hashes, pinned runtime DLL proofs,
-# and the Tauri updater signature for the signed NSIS installer.
+# canonical app/runtime payload proofs, and the Tauri updater signature for the
+# signed NSIS installer.
 nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts windows
 
 # iOS IPA: run on macOS with Xcode selected.