@@ -249,6 +249,18 @@ jobs:
             family: "zts"
             artifact: "phpstan_turbo"
             suffix: "-zts"
+          # The macOS slices are merged into one universal binary (and ad-hoc
+          # signed) by the turbo-macos-universal job below, so their artifacts
+          # carry the turbo-slice prefix that the phpstan_turbo-* download
+          # patterns in the aggregate and commit jobs do not match.
+          - name: "macos-x86_64"
+            runs-on: "macos-15-intel" # the last x86_64 macOS image, available until August 2027
+            family: "macos"
+            artifact: "turbo-slice"
+          - name: "macos-arm64"
+            runs-on: "macos-latest"
+            family: "macos"
+            artifact: "turbo-slice"
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
@@ -395,6 +407,67 @@ jobs:
           path: "turbo-ext/phpstan_turbo.so"
           if-no-files-found: "error"
 
+  turbo-macos-universal:
+    name: "Turbo macOS Universal Binary"
+    needs: "turbo-compile"
+    runs-on: "macos-latest"
+    timeout-minutes: 30
+
+    strategy:
+      fail-fast: false
+      matrix:
+        php-version: ["8.4", "8.5"]
+
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        with:
+          egress-policy: audit
+
+      - name: "Download x86_64 slice"
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: "turbo-slice-macos-x86_64-php${{ matrix.php-version }}"
+          path: "slice-x86_64"
+
+      - name: "Download arm64 slice"
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: "turbo-slice-macos-arm64-php${{ matrix.php-version }}"
+          path: "slice-arm64"
+
+      - name: "Merge the slices into a universal binary"
+        run: |
+          lipo -create slice-x86_64/phpstan_turbo.so slice-arm64/phpstan_turbo.so -output phpstan_turbo.so
+          lipo -info phpstan_turbo.so
+
+      # On arm64 AMFI refuses to map unsigned code, so the binary must carry
+      # at least an ad-hoc signature. lipo preserves the linker's per-slice
+      # ad-hoc signatures, but re-sign deliberately instead of relying on
+      # that. Quarantine (and thus Gatekeeper/notarization) only applies to
+      # browser downloads — composer/git/curl installs never see it — so an
+      # ad-hoc signature is enough and needs no secrets.
+      - name: "Ad-hoc sign the universal binary"
+        run: |
+          codesign --force --sign - phpstan_turbo.so
+          codesign --verify --verbose=2 phpstan_turbo.so
+
+      - name: "Install PHP"
+        uses: "shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240" # v2.37.2
+        with:
+          coverage: "none"
+          php-version: "${{ matrix.php-version }}"
+
+      - name: "Verify the universal binary loads"
+        run: php -d extension="$PWD/phpstan_turbo.so" -m | grep phpstan_turbo
+
+      - name: "Upload universal binary artifact"
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: "phpstan_turbo-macos-php${{ matrix.php-version }}"
+          path: "phpstan_turbo.so"
+          if-no-files-found: "error"
+
   turbo-compile-windows:
     name: "Compile Turbo Extension (Windows)"
     # windows-latest and windows-2025 serve the VS2026 image, whose 14.5x
@@ -518,6 +591,7 @@ jobs:
     needs:
       - turbo-compile
       - turbo-compile-windows
+      - turbo-macos-universal
     runs-on: "ubuntu-latest"
     timeout-minutes: 5
 
@@ -562,6 +636,7 @@ jobs:
     needs:
       - turbo-compile
       - turbo-compile-windows
+      - turbo-macos-universal
     runs-on: ${{ matrix.operating-system }}
     timeout-minutes: 60
 
@@ -580,6 +655,17 @@ jobs:
         php-version: ["8.4", "8.5"]
         ts: ["nts", "zts"]
         script: ["make tests", "make phpstan"]
+        # macOS runs the shipped ad-hoc-signed universal binary; there is no
+        # macOS zts build, and 8.4 coverage comes from the other legs.
+        include:
+          - operating-system: "macos-latest"
+            php-version: "8.5"
+            ts: "nts"
+            script: "make tests"
+          - operating-system: "macos-latest"
+            php-version: "8.5"
+            ts: "nts"
+            script: "make phpstan"
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
@@ -603,7 +689,7 @@ jobs:
       - name: "Download extension artifact"
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: "phpstan_turbo-${{ matrix.operating-system == 'windows-latest' && 'windows-x86_64' || 'linux-gnu-x86_64' }}-php${{ matrix.php-version }}${{ matrix.ts == 'zts' && '-zts' || '' }}"
+          name: "phpstan_turbo-${{ matrix.operating-system == 'windows-latest' && 'windows-x86_64' || matrix.operating-system == 'macos-latest' && 'macos' || 'linux-gnu-x86_64' }}-php${{ matrix.php-version }}${{ matrix.ts == 'zts' && '-zts' || '' }}"
           path: "turbo-ext"
 
       - name: "Install extension"
@@ -641,11 +727,12 @@ jobs:
           '
 
       - name: "Run"
-        # The memo's per-worker footprint grows with files-per-worker; a
-        # future few-core leg (macOS runners) needs 1G where these many-worker
-        # runners stay under the default 450M.
+        # The memo's per-worker footprint grows with files-per-worker; macOS
+        # runners have few cores, so each of their few workers analyses enough
+        # files to tip the default 450M limit that a many-worker runner
+        # stays under.
         env:
-          PHPSTAN_MEMORY_LIMIT: "450M"
+          PHPSTAN_MEMORY_LIMIT: ${{ matrix.operating-system == 'macos-latest' && '1G' || '450M' }}
         # The Windows runner image ships GNU make only inside its MSYS2
         # install, which is not on PATH.
         run: |
@@ -836,6 +923,7 @@ jobs:
       - turbo-version
       - turbo-compile
       - turbo-compile-windows
+      - turbo-macos-universal
     runs-on: "ubuntu-latest"
     timeout-minutes: 60
     steps: