diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8f1480c..b72314d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -192,12 +192,29 @@ jobs:
             fi
           done
 
+      - name: Generate DMG SHA256 Checksums
+        working-directory: src/frontend/release
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          dmgs=(*.dmg)
+          if [ ${#dmgs[@]} -eq 0 ]; then
+            echo "::error::No DMG files found in src/frontend/release"
+            exit 1
+          fi
+          for dmg in "${dmgs[@]}"; do
+            shasum -a 256 "$dmg" > "${dmg}.sha256"
+            echo "Generated checksum:"
+            cat "${dmg}.sha256"
+          done
+
       - name: Upload Build Artifacts
         uses: actions/upload-artifact@v7
         with:
           name: dmg-assets
           path: |
             src/frontend/release/*.dmg
+            src/frontend/release/*.dmg.sha256
             src/frontend/release/*.zip
             src/frontend/release/latest-mac.yml
           retention-days: 90
@@ -211,6 +228,10 @@ jobs:
           echo "**DMG Files:**" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           ls -lh src/frontend/release/*.dmg 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' >> $GITHUB_STEP_SUMMARY || echo "No DMG files found" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**SHA256 Checksums:**" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          cat src/frontend/release/*.dmg.sha256 2>/dev/null | awk '{print "- `" $1 "`  " $2}' >> $GITHUB_STEP_SUMMARY || echo "No checksums found" >> $GITHUB_STEP_SUMMARY
 
   # ──────────────────────────────────────────────────────────────────────
   # Linux binary build (amd64)
@@ -581,6 +602,7 @@ jobs:
           # Collect all release assets into a flat directory
           mkdir -p assets
           cp release-assets/dmg-assets/*.dmg assets/ 2>/dev/null || true
+          cp release-assets/dmg-assets/*.dmg.sha256 assets/ 2>/dev/null || true
           cp release-assets/dmg-assets/*.zip assets/ 2>/dev/null || true
           cp release-assets/dmg-assets/latest-mac.yml assets/ 2>/dev/null || true
           cp release-assets/linux-assets/*.tar.gz assets/ 2>/dev/null || true
diff --git a/packaging/homebrew/Casks/kiji-privacy-proxy.rb b/packaging/homebrew/Casks/kiji-privacy-proxy.rb
new file mode 100644
index 0000000..2a39bc9
--- /dev/null
+++ b/packaging/homebrew/Casks/kiji-privacy-proxy.rb
@@ -0,0 +1,29 @@
+cask "kiji-privacy-proxy" do
+  version "0.0.0"
+  sha256 "0000000000000000000000000000000000000000000000000000000000000000"
+
+  url "https://github.com/dataiku/kiji-proxy/releases/download/v#{version}/Kiji-Privacy-Proxy-#{version}.dmg",
+      verified: "github.com/dataiku/kiji-proxy/"
+  name "Kiji Privacy Proxy"
+  desc "Privacy layer that masks PII in requests to AI APIs"
+  homepage "https://github.com/dataiku/kiji-proxy"
+
+  livecheck do
+    url :url
+    strategy :github_latest
+  end
+
+  depends_on macos: ">= :high_sierra"
+
+  app "Kiji Privacy Proxy.app"
+
+  zap trash: [
+    "~/.kiji-proxy",
+    "~/Library/Application Support/Kiji Privacy Proxy",
+    "~/Library/Caches/com.kiji.proxy",
+    "~/Library/Caches/com.kiji.proxy.ShipIt",
+    "~/Library/Logs/Kiji Privacy Proxy",
+    "~/Library/Preferences/com.kiji.proxy.plist",
+    "~/Library/Saved Application State/com.kiji.proxy.savedState",
+  ]
+end