diff --git a/.github/workflows/desktop-release.yml b/.github/workflows/desktop-release.yml
index eaf05005a..1b493a9ff 100644
--- a/.github/workflows/desktop-release.yml
+++ b/.github/workflows/desktop-release.yml
@@ -49,8 +49,12 @@ jobs:
       fail-fast: false
       matrix:
         include:
+          # Intel is cross-compiled on the Apple Silicon runner: the
+          # macos-15-intel runners take roughly twice as long to compile, and
+          # every bundled sidecar is either prebuilt per target (K-brain) or
+          # cross-compiled with CGO disabled (gateway).
           - name: Intel
-            runner: macos-15-intel
+            runner: macos-15
             target: x86_64-apple-darwin
             suffix: x64
           - name: Apple Silicon
@@ -82,7 +86,9 @@ jobs:
 
       - uses: Swatinem/rust-cache@v2
         with:
-          workspaces: crates/agent-gui/src-tauri
+          # Cargo workspace root is the repo root, so artifacts live in ./target.
+          workspaces: ". -> target"
+          key: ${{ matrix.target }}
 
       - name: Install frontend dependencies
         run: pnpm install --frozen-lockfile --filter liveagent... --filter @liveagent/gateway-webui...
@@ -164,6 +170,18 @@ jobs:
         working-directory: crates/agent-gui
         run: pnpm tauri build --config src-tauri/tauri.macos.release.conf.json --config src-tauri/tauri.macos.preview.conf.json --config "$LIVEAGENT_TAURI_VERSION_CONFIG" --target "${{ matrix.target }}" --bundles app
 
+      - name: Verify macOS executables match the target architecture
+        run: |
+          set -euo pipefail
+          expected="$(case "${{ matrix.target }}" in x86_64-*) echo x86_64 ;; aarch64-*) echo arm64 ;; esac)"
+          macos_dir="target/${{ matrix.target }}/release/bundle/macos/LiveAgent.app/Contents/MacOS"
+          for bin in "$macos_dir"/*; do
+            file -b "$bin" | grep -q '^Mach-O' || continue
+            archs="$(lipo -archs "$bin")"
+            echo "$(basename "$bin"): $archs"
+            [ "$archs" = "$expected" ] || { echo "::error::$bin is $archs, expected $expected"; exit 1; }
+          done
+
       - name: Verify macOS package contains backend and computer helper
         run: node scripts/release/verify-kbrain-packaging.mjs --target "${{ matrix.target }}" --binary-dir crates/agent-gui/src-tauri/binaries --bundle-dir "target/${{ matrix.target }}/release/bundle/macos/LiveAgent.app" --no-receipt-hash
 
@@ -237,7 +255,7 @@ jobs:
 
       - uses: Swatinem/rust-cache@v2
         with:
-          workspaces: crates/agent-gui/src-tauri
+          workspaces: ". -> target"
 
       - name: Install frontend dependencies
         run: pnpm install --frozen-lockfile --filter liveagent... --filter @liveagent/gateway-webui...
@@ -372,7 +390,7 @@ jobs:
 
       - uses: Swatinem/rust-cache@v2
         with:
-          workspaces: crates/agent-gui/src-tauri
+          workspaces: ". -> target"
 
       - name: Install frontend dependencies
         run: pnpm install --frozen-lockfile --filter liveagent... --filter @liveagent/gateway-webui...