diff --git a/scripts/install-flutter-mac-dmg.sh b/scripts/install-flutter-mac-dmg.sh
index 2d7ca4e4..870dca7d 100755
--- a/scripts/install-flutter-mac-dmg.sh
+++ b/scripts/install-flutter-mac-dmg.sh
@@ -4,7 +4,8 @@ set -euo pipefail
 ROOT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 DIST_DIR="$ROOT_DIR/dist"
 APP_NAME="${APP_NAME:-XWorkmate}"
-TARGET_APP="/Applications/$APP_NAME.app"
+TARGET_APP="${TARGET_APP:-/Applications/$APP_NAME.app}"
+STAGING_APP="${STAGING_APP:-${TARGET_APP}.installing}"
 DMG_PATH="${1:-}"
 APP_NAME_SLUG="$(printf '%s' "$APP_NAME" | tr '[:upper:]' '[:lower:]' | tr ' ' '-')"
 MOUNT_POINT="$(mktemp -d "/tmp/${APP_NAME_SLUG}-install.XXXXXX")"
@@ -12,11 +13,38 @@ OPEN_AFTER_INSTALL="${OPEN_AFTER_INSTALL:-0}"
 
 cleanup() {
   hdiutil detach "$MOUNT_POINT" -quiet 2>/dev/null || true
+  rm -rf "$STAGING_APP" 2>/dev/null || true
   rmdir "$MOUNT_POINT" 2>/dev/null || true
 }
 
 trap cleanup EXIT
 
+validate_app_bundle() {
+  local app_path="$1"
+  local info_plist="$app_path/Contents/Info.plist"
+  local executable="$app_path/Contents/MacOS/$APP_NAME"
+  local frameworks_dir="$app_path/Contents/Frameworks"
+
+  [[ -d "$app_path" ]] || {
+    echo "Installed app bundle missing: $app_path" >&2
+    return 1
+  }
+  [[ -f "$info_plist" ]] || {
+    echo "Installed app is missing Info.plist: $info_plist" >&2
+    return 1
+  }
+  [[ -x "$executable" ]] || {
+    echo "Installed app is missing executable: $executable" >&2
+    return 1
+  }
+  [[ -d "$frameworks_dir" ]] || {
+    echo "Installed app is missing Frameworks directory: $frameworks_dir" >&2
+    return 1
+  }
+
+  codesign --verify --deep --verbose=2 "$app_path"
+}
+
 if [[ -z "$DMG_PATH" ]]; then
   shopt -s nullglob
   dmgs=("$DIST_DIR"/"$APP_NAME"-*.dmg)
@@ -49,8 +77,14 @@ if [[ -d "$TARGET_APP" ]]; then
   rm -rf "$TARGET_APP"
 fi
 
-echo "Installing to $TARGET_APP..."
-ditto "$SOURCE_APP" "$TARGET_APP"
+rm -rf "$STAGING_APP"
+echo "Installing to staging app $STAGING_APP..."
+ditto "$SOURCE_APP" "$STAGING_APP"
+validate_app_bundle "$STAGING_APP"
+
+echo "Promoting staging app to $TARGET_APP..."
+mv "$STAGING_APP" "$TARGET_APP"
+validate_app_bundle "$TARGET_APP"
 xattr -dr com.apple.quarantine "$TARGET_APP" 2>/dev/null || true
 
 if [[ "$OPEN_AFTER_INSTALL" == "1" ]]; then