diff --git a/Snapzy/Services/AppIdentity/AppIdentityManager.swift b/Snapzy/Services/AppIdentity/AppIdentityManager.swift
index f63f477a..626bda1b 100644
--- a/Snapzy/Services/AppIdentity/AppIdentityManager.swift
+++ b/Snapzy/Services/AppIdentity/AppIdentityManager.swift
@@ -81,12 +81,22 @@ final class AppIdentityManager: ObservableObject {
       issues.append(.unexpectedBundleIdentifier(Bundle.main.bundleIdentifier))
     }
 
-    if quarantined && !bundleURL.path.hasPrefix("/Applications/") {
-      issues.append(.outsideApplications(bundleURL))
-    }
-
+    // Quarantine flag check: Only flag as an issue if the app is running from
+    // outside standard Applications folders. Homebrew Cask upgrades (`brew upgrade`)
+    // use command-line `mv`/`cp` which preserves the quarantine xattr even after
+    // the app is placed in /Applications. Since the app is Apple Notarized, macOS
+    // Gatekeeper handles the quarantine-to-clearance flow automatically on first
+    // launch. Flagging quarantine inside /Applications would be a false positive
+    // that blocks permissions after every Cask upgrade (see issue #337).
     if quarantined {
-      issues.append(.quarantined)
+      let homePath = NSHomeDirectory()
+      let isInsideApplications =
+        bundleURL.path.hasPrefix("/Applications/")
+        || bundleURL.path.hasPrefix("\(homePath)/Applications/")
+      if !isInsideApplications {
+        issues.append(.outsideApplications(bundleURL))
+        issues.append(.quarantined)
+      }
     }
 
     // Skip strict signature validation in debug builds — Xcode uses ad-hoc