diff --git a/.github/workflows/macos-release-build.yml b/.github/workflows/macos-release-build.yml
index b4503d765..a41f21cdf 100644
--- a/.github/workflows/macos-release-build.yml
+++ b/.github/workflows/macos-release-build.yml
@@ -134,6 +134,9 @@ jobs:
           p12-file-base64: ${{ secrets.macOS_CERTIFICATES_P12_For_App_BASE64 }}
           p12-password: ${{ secrets.macOS_CERTIFICATES_P12_PASSWORD }}
 
+      - name: Import provisioning profile for .app
+        run: echo "${{ secrets.macOS_PROVISIONING_PROFILE }}" | base64 --decode > zen.provisionprofile
+
       - name: Package
         env:
           SURFER_COMPAT: ${{ matrix.arch }}
diff --git a/build/codesign/browser.developer.entitlements.xml b/build/codesign/browser.developer.entitlements.xml
index f8f054ac5..98dc54ba4 100644
--- a/build/codesign/browser.developer.entitlements.xml
+++ b/build/codesign/browser.developer.entitlements.xml
@@ -36,5 +36,7 @@
     <key>com.apple.application-identifier</key>
     <string>H36NPCN86W.app.zen-browser.zen</string>
 
+    <!-- For platform passkey (webauthn) support -->
+    <key>com.apple.developer.web-browser.public-key-credential</key><true/>
   </dict>
 </plist>
diff --git a/build/codesign/codesign.bash b/build/codesign/codesign.bash
index f75357125..3cc64edcc 100644
--- a/build/codesign/codesign.bash
+++ b/build/codesign/codesign.bash
@@ -38,6 +38,7 @@ usage ()
   echo  "    -i <IDENTITY>"
   echo  "    -b <ENTITLEMENTS-FILE>"
   echo  "    -p <CHILD-ENTITLEMENTS-FILE>"
+  echo  "    -f <PROVOSION-PROFILE>"
   echo  "    [-o <OUTPUT-DMG-FILE>]"
   exit -1
 }
@@ -62,6 +63,7 @@ while getopts "a:i:b:o:p:" opt; do
     i ) IDENTITY=$OPTARG ;;
     b ) BROWSER_ENTITLEMENTS_FILE=$OPTARG ;;
     p ) PLUGINCONTAINER_ENTITLEMENTS_FILE=$OPTARG ;;
+    f ) PROVISIONING_PROFILE=$OPTARG ;;
     o ) OUTPUT_DMG_FILE=$OPTARG ;;
     \? ) usage; exit -1 ;;
   esac
@@ -104,6 +106,7 @@ fi
 echo "-------------------------------------------------------------------------"
 echo "bundle:                              $BUNDLE"
 echo "identity:                            $IDENTITY"
+echo "Provisioning profile:                $PROVISIONING_PROFILE"
 echo "browser entitlements file:           $BROWSER_ENTITLEMENTS_FILE"
 echo "plugin-container entitlements file:  $PLUGINCONTAINER_ENTITLEMENTS_FILE"
 echo "output dmg file (optional):          $OUTPUT_DMG_FILE"
@@ -127,6 +130,7 @@ codesign --force -o runtime --verbose --sign "$IDENTITY" --deep \
 
 # Sign zen main executable
 codesign --force -o runtime --verbose --sign "$IDENTITY" --deep \
+--provisioning-profile ${PROVISIONING_PROFILE} \
 --entitlements ${BROWSER_ENTITLEMENTS_FILE} \
 "${BUNDLE}"/Contents/MacOS/zen
 
@@ -140,6 +144,7 @@ codesign --force -o runtime --verbose --sign "$IDENTITY" {} \;
 
 # Sign the main bundle
 codesign --force -o runtime --verbose --sign "$IDENTITY" \
+--provisioning-profile ${PROVISIONING_PROFILE} \
 --entitlements ${BROWSER_ENTITLEMENTS_FILE} "${BUNDLE}"
 
 # Sign the plugin-container bundle with deep
diff --git a/package.json b/package.json
index 5d096bd61..b7467103b 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
   },
   "homepage": "https://github.com/zen-browser/core#readme",
   "dependencies": {
-    "@zen-browser/surfer": "^1.8.2"
+    "@zen-browser/surfer": "^1.8.7"
   },
   "devDependencies": {
     "husky": "^9.1.5",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index da596b154..af3ab6f60 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -9,8 +9,8 @@ importers:
   .:
     dependencies:
       '@zen-browser/surfer':
-        specifier: ^1.8.2
-        version: 1.8.2
+        specifier: ^1.8.7
+        version: 1.8.7
     devDependencies:
       husky:
         specifier: ^9.1.5
@@ -119,8 +119,8 @@ packages:
   '@types/node@17.0.45':
     resolution: {integrity: sha512-w+tIMs3rq2afQdsPJlODhoUEKzFP1ayaoyl1CcnwtIlsVe7K7bA1NGm4s3PraqTLlXnbIN84zuBlxBWo1u9BLw==}
 
-  '@zen-browser/surfer@1.8.2':
-    resolution: {integrity: sha512-6odt1j7haMFjOffz+nt4+AWXJC8X3DW+ha7+nVdvqD6/mBiTtT8LnDQ0COQbZt0FMBTNB9nRlglm1jtHCOzE6g==}
+  '@zen-browser/surfer@1.8.7':
+    resolution: {integrity: sha512-enQDB2Btnviw3BlAadi288QcN+UpY9R4OSUdubybHvC7pfOC4+LVzI9FSvsXXeUoyMj1q19RSz3R+XW1jK9eqQ==}
     hasBin: true
 
   ansi-escapes@7.0.0:
@@ -1003,7 +1003,7 @@ snapshots:
 
   '@types/node@17.0.45': {}
 
-  '@zen-browser/surfer@1.8.2':
+  '@zen-browser/surfer@1.8.7':
     dependencies:
       '@resvg/resvg-js': 1.4.0
       async-icns: 1.0.2