diff --git a/.github/scripts/release-workflow-contract_test.py b/.github/scripts/release-workflow-contract_test.py
index 5f797251c2..0b291c633a 100644
--- a/.github/scripts/release-workflow-contract_test.py
+++ b/.github/scripts/release-workflow-contract_test.py
@@ -726,6 +726,26 @@ class ReleaseWorkflowContractTest(unittest.TestCase):
         self.assertIn('"${UPDATER_SIGNING_ENABLED:-false}" = "true"', collect)
         self.assertIn('"$DESKTOP_ASSET_VERIFIER" --require-updaters', collect)
 
+    def test_unsigned_macos_warning_includes_launch_recovery_command(self) -> None:
+        warning = step_block("Add unsigned desktop warning to release notes")
+
+        self.assertIn("macos_unsigned=false", warning)
+        self.assertIn("macos_unsigned=true", warning)
+        branch_if = 'if [ "$macos_unsigned" = "true" ]; then'
+        command = "xattr -d com.apple.quarantine /Applications/Kandev.app"
+
+        self.assertIn(branch_if, warning)
+        self.assertIn("verify the checksum", warning)
+        self.assertIn(command, warning)
+        self.assertLess(
+            warning.index("verify the checksum"),
+            warning.index(command),
+        )
+        branch_start = warning.index(branch_if)
+        branch_end = warning.index("\n            fi", branch_start)
+        branch_body = warning[branch_start:branch_end]
+        self.assertIn(command, branch_body)
+
     def test_release_asset_globs_are_disjoint_and_upload_sequentially(self) -> None:
         publish = step_block("Publish release")
         files = re.search(r"\n          files: \|\n((?:            \S+\n)+)", publish)
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ef04893e6a..18c4790d3a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1975,8 +1975,10 @@ jobs:
           set -euo pipefail
 
           unsigned=()
+          macos_unsigned=false
           if ! bash scripts/release/desktop-signing-ready.sh macos >/dev/null 2>&1; then
             unsigned+=("macOS")
+            macos_unsigned=true
           fi
           if ! bash scripts/release/desktop-signing-ready.sh windows >/dev/null 2>&1; then
             unsigned+=("Windows")
@@ -1994,6 +1996,14 @@ jobs:
             echo "> [!WARNING]"
             echo "> $platforms desktop installers in this release are unsigned development builds."
             echo "> They may require manual OS security bypasses and are not trusted downloads."
+            if [ "$macos_unsigned" = "true" ]; then
+              echo ">"
+              echo "> If macOS blocks Kandev after you verify the checksum, run:"
+              echo ">"
+              echo '> ```bash'
+              echo "> xattr -d com.apple.quarantine /Applications/Kandev.app"
+              echo '> ```'
+            fi
             echo
             cat RELEASE_NOTES.md
           } > "$tmp"