diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 70c132730..7e3be8889 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -292,13 +292,6 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # GITHUB_TOKEN is limited to the current repository
           DISCORD_WEBHOOK_ID: ${{ secrets.DISCORD_WEBHOOK_ID }}
           DISCORD_WEBHOOK_TOKEN: ${{ secrets.DISCORD_WEBHOOK_TOKEN }}
-
-      - name: Notarize macOS app # TODO: move to goreleaser.yml
-        shell: bash
-        run: |
-          bin/notarize.sh dist/darwin/defang_*_macOS.zip
-        working-directory: src
-        env:
           MACOS_NOTARIZATION_APPLE_ID: ${{ secrets.MACOS_NOTARIZATION_APPLE_ID }}
           MACOS_NOTARIZATION_TEAM_ID: ${{ secrets.MACOS_NOTARIZATION_TEAM_ID }}
           MACOS_NOTARIZATION_APP_PW: ${{ secrets.MACOS_NOTARIZATION_APP_PW }}
diff --git a/src/.goreleaser.yml b/src/.goreleaser.yml
index 429c9cd08..a285438fc 100644
--- a/src/.goreleaser.yml
+++ b/src/.goreleaser.yml
@@ -1,4 +1,4 @@
-# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
+# yaml-language-server: $schema=https://goreleaser.com/static/schema-pro.json
 project_name: defang
 builds:
   - id: defang-mac
@@ -37,13 +37,23 @@ universal_binaries:
 
 archives:
   - id: defang-archive
+    builds:
+      - defang-cli
     format_overrides:
-      - goos: darwin
-        format: zip
       - goos: windows
         format: zip
+    name_template: '{{ .ProjectName }}_{{ .Version }}_{{ .Os }}{{ if ne .Arch "all" }}_{{ .Arch }}{{ end }}{{ with .Arm }}v{{ . }}{{ end }}{{ with .Mips }}_{{ . }}{{ end }}{{ if not (eq .Amd64 "v1") }}{{ .Amd64 }}{{ end }}'
+  - id: defang-archive-mac
+    builds:
+      - defang-macfat
+    format_overrides:
+      - goos: darwin
+        format: zip
     # replace "darwin" with "macOS" in the filename; replace "all" with ""; NOTE: if you change this, also change go.yml GitHub Actions workflow
-    name_template: '{{ .ProjectName }}_{{ .Version }}_{{ if eq .Os "darwin" }}macOS{{ else }}{{ .Os }}{{ end }}{{ if ne .Arch "all" }}_{{ .Arch }}{{ end }}{{ with .Arm }}v{{ . }}{{ end }}{{ with .Mips }}_{{ . }}{{ end }}{{ if not (eq .Amd64 "v1") }}{{ .Amd64 }}{{ end }}'
+    name_template: '{{ .ProjectName }}_{{ .Version }}_macOS{{ if ne .Arch "all" }}_{{ .Arch }}{{ end }}{{ with .Arm }}v{{ . }}{{ end }}{{ with .Mips }}_{{ . }}{{ end }}{{ if not (eq .Amd64 "v1") }}{{ .Amd64 }}{{ end }}'
+    hooks:
+      after:
+        - ./bin/notarize.sh "{{ .Artifacts[0].Path }}"
 
 release:
   github:
@@ -67,8 +77,8 @@ release:
   # prerelease: "true"
 
 nix:
-  # commit_author: defang-io
   - homepage: https://defang.io/
+    # commit_author: defang-io
     description: Defang is the easiest way for developers to create and deploy their containerized applications
     license: "mit"
     repository:
@@ -81,7 +91,7 @@ nix:
         --fish <($out/bin/defang completion fish)
 
 changelog:
-  use: github
+  use: github-native
   filters:
     exclude:
       # Ignore messages like "defang: v0.5.3 -> v0.5.4" (which are actually for the previous version)