diff --git a/01_Project/syncthingStatus/Info.plist b/01_Project/syncthingStatus/Info.plist
index 61a3803..397851c 100644
--- a/01_Project/syncthingStatus/Info.plist
+++ b/01_Project/syncthingStatus/Info.plist
@@ -20,5 +20,7 @@
 	<string>eH6joIk0G+i5Hur25e/9B4hF3jN8q5lBqXzMxuOfcxw=</string>
 	<key>SUEnableAutomaticChecks</key>
 	<true/>
+	<key>SUEnableInstallerLauncherService</key>
+	<true/>
 </dict>
 </plist>
diff --git a/01_Project/syncthingStatus/syncthingStatus.entitlements b/01_Project/syncthingStatus/syncthingStatus.entitlements
index 0c67376..77493f9 100644
--- a/01_Project/syncthingStatus/syncthingStatus.entitlements
+++ b/01_Project/syncthingStatus/syncthingStatus.entitlements
@@ -1,5 +1,11 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
-<dict/>
+<dict>
+	<key>com.apple.security.temporary-exception.mach-lookup.global-name</key>
+	<array>
+		<string>$(PRODUCT_BUNDLE_IDENTIFIER)-spks</string>
+		<string>$(PRODUCT_BUNDLE_IDENTIFIER)-spki</string>
+	</array>
+</dict>
 </plist>
diff --git a/README.md b/README.md
index e83969d..6735f9f 100644
--- a/README.md
+++ b/README.md
@@ -174,7 +174,7 @@ Or visit the [Releases page](https://github.com/Xpycode/syncthingStatus/releases
 
 > **Note**: The app is notarized by Apple and will run without security warnings.
 
-> **Auto-update troubleshooting**: if the in-app update fails with _"An error occurred while launching the installer"_, the bundle on disk is at a malformed path (e.g. `/Applications/syncthingStatus.app.1` or any name without the `.app` suffix — usually a Finder rename mishap). macOS won't dispatch Sparkle's XPC services unless the parent bundle ends in `.app`. Run [`tools/repair-install.sh`](tools/repair-install.sh) for a clean re-install that preserves your settings, or just trash the malformed bundle in `/Applications/` and drag-install fresh from the DMG.
+> **Auto-update troubleshooting**: if the in-app update fails with _"An error occurred while launching the installer"_, the bundle on disk may be at a malformed path (e.g. `/Applications/syncthingStatus.app.1` or any name without the `.app` suffix — usually a Finder rename mishap). macOS won't dispatch Sparkle's XPC services unless the parent bundle ends in `.app`. Sandboxed builds also need Sparkle's installer launcher service and Mach lookup entitlements; release notarization now asserts both so future packages fail fast instead of shipping a broken updater. Run [`tools/repair-install.sh`](tools/repair-install.sh) for a clean re-install that preserves your settings, or just trash the malformed bundle in `/Applications/` and drag-install fresh from the DMG.
 
 ### Build from Source
 1. Clone this repository:
diff --git a/tools/notarize.sh b/tools/notarize.sh
index 946ddf9..82c0381 100755
--- a/tools/notarize.sh
+++ b/tools/notarize.sh
@@ -117,6 +117,20 @@ for key in com.apple.security.app-sandbox com.apple.security.network.client; do
 done
 echo "  ✓ sandbox + network.client entitlements intact"
 
+# Sandboxed Sparkle apps must opt into the installer launcher service and allow
+# Sparkle to communicate with its installer/status helpers via temporary Mach lookup.
+bundle_id="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "$APP/Contents/Info.plist")"
+installer_launcher="$(/usr/libexec/PlistBuddy -c 'Print :SUEnableInstallerLauncherService' "$APP/Contents/Info.plist" 2>/dev/null || true)"
+if [ "$installer_launcher" != "true" ]; then
+    echo "error: SUEnableInstallerLauncherService is not true; sandboxed Sparkle installs will fail" >&2
+    exit 1
+fi
+for service in "${bundle_id}-spks" "${bundle_id}-spki"; do
+    printf '%s' "$ent" | grep -Fq "$service" \
+        || { echo "error: exported app lost Sparkle Mach lookup entitlement $service" >&2; exit 1; }
+done
+echo "  ✓ Sparkle sandbox installer configuration intact"
+
 # --- 3. submit to the notary service ---------------------------------------
 mkdir -p "$OUT_DIR"
 rm -f "$ZIP"