diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e4ccdc4d6..f3e8200fe 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -63,11 +63,12 @@ jobs:
             name: macos-arm64
             target: aarch64-apple-darwin
             runs-on: macos-14
-    #          - os: macos
-    #            name: macos
-    #            target: universal2-apple-darwin
-    #            runs-on: macos-12
     steps:
+      - if: matrix.os == 'macos'
+        uses: apple-actions/import-codesign-certs@v3
+        with:
+          p12-file-base64: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_CERTS_P12 }}
+          p12-password: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_CERTS_P12_PASS }}
       - uses: actions/checkout@v4
       - uses: actions/cache@v4
         with:
diff --git a/scripts/build-tarball.sh b/scripts/build-tarball.sh
index 6bff2e36f..b1fcd168f 100755
--- a/scripts/build-tarball.sh
+++ b/scripts/build-tarball.sh
@@ -94,6 +94,10 @@ cp LICENSE dist/mise/LICENSE
 cp {,dist/mise/}man/man1/mise.1
 cp {,dist/mise/}share/fish/vendor_conf.d/mise-activate.fish
 
+if [[ "$(get_os)" == "macos" ]]; then
+  codesign -f -s "Developer ID Application: Jeffrey Dickey (4993Y37DX6)" dist/mise/bin/mise
+fi
+
 cd dist
 tar -cJf "$BASENAME.tar.xz" mise
 tar -czf "$BASENAME.tar.gz" mise
diff --git a/src/cli/direnv/envrc.rs b/src/cli/direnv/envrc.rs
index 67c50e4c0..535f64ee0 100644
--- a/src/cli/direnv/envrc.rs
+++ b/src/cli/direnv/envrc.rs
@@ -1,7 +1,8 @@
-use std::fs::{create_dir_all, File};
+use std::fs::File;
 use std::io::Write;
 
 use eyre::Result;
+use xx::file;
 
 use crate::config::Config;
 use crate::env;
@@ -23,7 +24,7 @@ impl Envrc {
             .join(hash_to_str(&env::current_dir()?) + ".envrc");
 
         // TODO: exit early if envrc_path exists and is up to date
-        create_dir_all(envrc_path.parent().unwrap())?;
+        file::mkdirp(envrc_path.parent().unwrap())?;
         let mut file = File::create(&envrc_path)?;
 
         writeln!(
diff --git a/src/cli/exec.rs b/src/cli/exec.rs
index f9f906731..f3fd040ce 100644
--- a/src/cli/exec.rs
+++ b/src/cli/exec.rs
@@ -70,7 +70,7 @@ impl Exec {
         self.exec(program, args, env)
     }
 
-    #[cfg(not(test))]
+    #[cfg(not(any(test, target_os = "windows")))]
     fn exec<T, U, E>(&self, program: T, args: U, env: BTreeMap<E, E>) -> Result<()>
     where
         T: IntoExecutablePath,
@@ -87,7 +87,7 @@ impl Exec {
         bail!("{:?} {err}", program.to_string_lossy())
     }
 
-    #[cfg(test)]
+    #[cfg(any(test, target_os = "windows"))]
     fn exec<T, U, E>(&self, program: T, args: U, env: BTreeMap<E, E>) -> Result<()>
     where
         T: IntoExecutablePath,
diff --git a/src/cli/render_mangen.rs b/src/cli/render_mangen.rs
index 1894d8f60..d9aa51852 100644
--- a/src/cli/render_mangen.rs
+++ b/src/cli/render_mangen.rs
@@ -2,6 +2,7 @@ use std::path::{Path, PathBuf};
 use std::{env, fs};
 
 use eyre::Result;
+use xx::file;
 
 use crate::cli::{version, Cli};
 
@@ -21,7 +22,7 @@ impl RenderMangen {
         man.render(&mut buffer)?;
 
         let out_dir = project_root().join("man").join("man1");
-        fs::create_dir_all(&out_dir)?;
+        file::mkdirp(&out_dir)?;
         fs::write(out_dir.join("mise.1"), buffer)?;
 
         Ok(())
diff --git a/src/git.rs b/src/git.rs
index 38826d630..a7eb4b8ad 100644
--- a/src/git.rs
+++ b/src/git.rs
@@ -1,9 +1,9 @@
-use std::fs::create_dir_all;
 use std::path::PathBuf;
 
 use duct::Expression;
 use eyre::{eyre, Result, WrapErr};
 use once_cell::sync::OnceCell;
+use xx::file;
 
 use crate::cmd;
 use crate::file::touch_dir;
@@ -98,7 +98,12 @@ impl Git {
     pub fn clone(&self, url: &str) -> Result<()> {
         debug!("cloning {} to {}", url, self.dir.display());
         if let Some(parent) = self.dir.parent() {
-            create_dir_all(parent)?;
+            file::mkdirp(parent)?;
+        }
+        if let Err(err) = git2::Repository::clone(url, &self.dir) {
+            warn!("git clone failed: {err:#}");
+        } else {
+            return Ok(());
         }
         match get_git_version() {
             Ok(version) => trace!("git version: {}", version),