diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..43d4221
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,2 @@
+# Signed updater fixtures must retain their exact committed bytes on every OS.
+src-tauri/tests/fixtures/updater/* -text
diff --git a/src-tauri/src/neoforge_repair.rs b/src-tauri/src/neoforge_repair.rs
index d393c15..9a77236 100644
--- a/src-tauri/src/neoforge_repair.rs
+++ b/src-tauri/src/neoforge_repair.rs
@@ -494,7 +494,11 @@ mod tests {
 
     impl Fixture {
         fn new() -> Self {
-            let root = Stage::new(&std::env::temp_dir()).unwrap();
+            // macOS temporary directories may use the system /var -> /private/var
+            // alias. Canonicalize only this trusted fixture anchor; production
+            // safe_path must continue rejecting root/descendant substitutions.
+            let temporary_root = std::env::temp_dir().canonicalize().unwrap();
+            let root = Stage::new(&temporary_root).unwrap();
             let game = root.0.join("game");
             let cache = root.0.join("cache");
             let input = jar_bytes(b"verified vanilla");