diff --git a/.github/workflows/build-matrix.yaml b/.github/workflows/build-matrix.yaml
index 5ca885aa55..2f6cf5a2f4 100644
--- a/.github/workflows/build-matrix.yaml
+++ b/.github/workflows/build-matrix.yaml
@@ -51,6 +51,7 @@ jobs:
     with:
       cmakePreset: "Release-macos-x86_64-clang"
       cachePrefix: ""
+    secrets: inherit
 
   build_macos_arm:
     name: "🍎 MacOS"
@@ -58,3 +59,4 @@ jobs:
     with:
       cmakePreset: "Release-macos-x86_64-clang"
       cachePrefix: ""
+    secrets: inherit
diff --git a/.github/workflows/macos-build-arm.yaml b/.github/workflows/macos-build-arm.yaml
index 59bf13ac23..e22061dd6e 100644
--- a/.github/workflows/macos-build-arm.yaml
+++ b/.github/workflows/macos-build-arm.yaml
@@ -9,6 +9,10 @@ on:
       cachePrefix:
         required: true
         type: string
+      uploadArtifacts:
+        required: false
+        type: boolean
+        default: false
 
 jobs:
   build:
@@ -43,11 +47,23 @@ jobs:
       - name: Build Project
         run: cmake --build build --parallel $((`sysctl -n hw.logicalcpu`))
 
+      - name: List libraries of gk
+        run: otool -L ./build/game/gk
+
       - name: Run Tests
         run: ./test.sh
 
+      - name: Prepare artifacts
+        if: ${{ inputs.uploadArtifacts }}
+        run: |
+          strip ./build/goalc/goalc
+          strip ./build/decompiler/extractor
+          strip ./build/game/gk
+          strip ./build/lsp/lsp
+
       - name: Upload artifact
         uses: actions/upload-artifact@v4
+        if: ${{ inputs.uploadArtifacts }}
         with:
           name: opengoal-macos-arm-${{ inputs.cachePrefix }}
           if-no-files-found: error
diff --git a/.github/workflows/macos-build.yaml b/.github/workflows/macos-build.yaml
index 4677f6d62d..065ee2a4cb 100644
--- a/.github/workflows/macos-build.yaml
+++ b/.github/workflows/macos-build.yaml
@@ -57,6 +57,9 @@ jobs:
       - name: Build Project
         run: cmake --build build --parallel $((`sysctl -n hw.logicalcpu`))
 
+      - name: List libraries of gk
+        run: otool -L ./build/game/gk
+
       - name: Run Tests
         run: ./test.sh
 
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 3df6edea64..c389207ff7 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -203,6 +203,9 @@ include_directories(SYSTEM third-party/inja)
 # TODO - probably integrate with ZSTD since we have it already
 set(CURL_USE_LIBSSH2 OFF)
 set(CURL_ZLIB OFF)
+# suddenly became enabled on macOS atleast, only needed for unicode URLs
+# wasn't being properly statically linked
+set(USE_LIBIDN2 OFF)
 if(WIN32)
     set(CURL_USE_SCHANNEL ON) # native Windows SSL support
 elseif(APPLE)