diff --git a/.github/workflows/pr_targets.yaml b/.github/workflows/pr_targets.yaml
index 1a8f905..6b51195 100644
--- a/.github/workflows/pr_targets.yaml
+++ b/.github/workflows/pr_targets.yaml
@@ -2,6 +2,9 @@ name: Upload Impacted Targets
 run-name: pr targets for ${{ github.ref_name }}
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   compute_pr_targets:
     name: compute
@@ -10,7 +13,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          lfs: truefilenames.sort();
+          lfs: true
 
       - uses: dtolnay/rust-toolchain@stable
 
@@ -19,10 +22,43 @@ jobs:
         with:
           tools: gh jq
 
-      - name: download mq
+      - name: Download mq binary
         run: |
-          gh release download --pattern='*.gz' --output mq.gz --clobber
-          tar -xf mq.gz
+          # Determine target triple based on runner OS and architecture
+          if [[ "${{ runner.os }}" == "Linux" ]]; then
+            if [[ "${{ runner.arch }}" == "X64" ]]; then
+              TARGET="x86_64-unknown-linux-gnu"
+              EXT="tar.gz"
+            elif [[ "${{ runner.arch }}" == "ARM64" ]]; then
+              TARGET="aarch64-unknown-linux-gnu"
+              EXT="tar.gz"
+            else
+              echo "Unsupported Linux architecture: ${{ runner.arch }}"
+              exit 1
+            fi
+          elif [[ "${{ runner.os }}" == "macOS" ]]; then
+            if [[ "${{ runner.arch }}" == "ARM64" ]]; then
+              TARGET="aarch64-apple-darwin"
+              EXT="zip"
+            else
+              echo "Unsupported macOS architecture: ${{ runner.arch }} (only ARM64 is supported)"
+              exit 1
+            fi
+          else
+            echo "Unsupported OS: ${{ runner.os }}"
+            exit 1
+          fi
+
+          # Download and extract the binary
+          PATTERN="mq-*-${TARGET}.${EXT}"
+          gh release download --pattern="$PATTERN" --output "mq.${EXT}" --clobber
+
+          if [[ "$EXT" == "zip" ]]; then
+            unzip -o mq.zip
+          else
+            tar -xf mq.tar.gz
+          fi
+          chmod +x mq
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/prerelease.yaml b/.github/workflows/prerelease.yaml
index 1d176db..55a9a50 100644
--- a/.github/workflows/prerelease.yaml
+++ b/.github/workflows/prerelease.yaml
@@ -14,7 +14,14 @@ jobs:
       matrix:
         include:
           - target: x86_64-unknown-linux-gnu
-            runs-on: [ubuntu-22.04]
+            runs-on: ubuntu-22.04
+            os: linux
+          - target: aarch64-unknown-linux-gnu
+            runs-on: ubuntu-22.04
+            os: linux
+          - target: aarch64-apple-darwin
+            runs-on: macos-14
+            os: macos
     runs-on: ${{ matrix.runs-on }}
 
     steps:
@@ -25,20 +32,25 @@ jobs:
       - name: Set up toolchains
         run: |
           rustup target add ${{ matrix.target }}
-          if [[ ${{ matrix.target }} == "aarch64-unknown-linux-gnu" ]]; then
+          if [[ "${{ matrix.target }}" == "aarch64-unknown-linux-gnu" ]]; then
             sudo apt update;
             sudo apt install -y binutils-aarch64-linux-gnu gcc-aarch64-linux-gnu;
           fi
 
       - name: update version
-        run:
-          sed -i "s/version = \"0.0.0\"/version = \"${{ github.event.inputs.release_tag }}\"/"
-          Cargo.toml
+        run: |
+          if [[ "${{ runner.os }}" == "macOS" ]]; then
+            sed -i '' "s/version = \"0.0.0\"/version = \"${{ github.event.inputs.release_tag }}\"/" Cargo.toml
+          else
+            sed -i "s/version = \"0.0.0\"/version = \"${{ github.event.inputs.release_tag }}\"/" Cargo.toml
+          fi
 
       - name: Build --release
         run: cargo build --release --target ${{ matrix.target }}
         env:
           HORTON_RELEASE: ${{ github.event.inputs.release_tag }}
+          CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
+          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
 
       - uses: actions/upload-artifact@v4
         with:
@@ -68,9 +80,17 @@ jobs:
           for target in $(ls build)
           do
             chmod u+x build/${target}/mq
-            tar czvf \
-              build/mq-${{ github.event.inputs.release_tag }}-${target}.tar.gz \
-              -C build/${target} mq
+            if [[ "${target}" == *"apple-darwin"* ]]; then
+              # macOS binaries use zip format
+              cd build/${target}
+              zip ../mq-${{ github.event.inputs.release_tag }}-${target}.zip mq
+              cd ../..
+            else
+              # Linux binaries use tar.gz format
+              tar czvf \
+                build/mq-${{ github.event.inputs.release_tag }}-${target}.tar.gz \
+                -C build/${target} mq
+            fi
           done
 
       - name: Create GH release and upload binary
@@ -78,4 +98,4 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           gh release create --target ${{ github.ref }}  \
-            ${{ github.event.inputs.release_tag }} ./build/*.tar.gz --generate-notes --prerelease
+            ${{ github.event.inputs.release_tag }} ./build/*.{tar.gz,zip} --generate-notes --prerelease
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 313794e..a15317e 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -14,7 +14,14 @@ jobs:
       matrix:
         include:
           - target: x86_64-unknown-linux-gnu
-            runs-on: [ubuntu-22.04]
+            runs-on: ubuntu-22.04
+            os: linux
+          - target: aarch64-unknown-linux-gnu
+            runs-on: ubuntu-22.04
+            os: linux
+          - target: aarch64-apple-darwin
+            runs-on: macos-14
+            os: macos
     runs-on: ${{ matrix.runs-on }}
 
     steps:
@@ -25,20 +32,25 @@ jobs:
       - name: Set up toolchains
         run: |
           rustup target add ${{ matrix.target }}
-          if [[ ${{ matrix.target }} == "aarch64-unknown-linux-gnu" ]]; then
+          if [[ "${{ matrix.target }}" == "aarch64-unknown-linux-gnu" ]]; then
             sudo apt update;
             sudo apt install -y binutils-aarch64-linux-gnu gcc-aarch64-linux-gnu;
           fi
 
       - name: update version
-        run:
-          sed -i "s/version = \"0.0.0\"/version = \"${{ github.event.inputs.release_tag }}\"/"
-          Cargo.toml
+        run: |
+          if [[ "${{ runner.os }}" == "macOS" ]]; then
+            sed -i '' "s/version = \"0.0.0\"/version = \"${{ github.event.inputs.release_tag }}\"/" Cargo.toml
+          else
+            sed -i "s/version = \"0.0.0\"/version = \"${{ github.event.inputs.release_tag }}\"/" Cargo.toml
+          fi
 
       - name: Build --release
         run: cargo build --release --target ${{ matrix.target }}
         env:
           HORTON_RELEASE: ${{ github.event.inputs.release_tag }}
+          CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
+          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
 
       - uses: actions/upload-artifact@v4
         with:
@@ -68,9 +80,17 @@ jobs:
           for target in $(ls build)
           do
             chmod u+x build/${target}/mq
-            tar czvf \
-              build/mq-${{ github.event.inputs.release_tag }}-${target}.tar.gz \
-              -C build/${target} mq
+            if [[ "${target}" == *"apple-darwin"* ]]; then
+              # macOS binaries use zip format
+              cd build/${target}
+              zip ../mq-${{ github.event.inputs.release_tag }}-${target}.zip mq
+              cd ../..
+            else
+              # Linux binaries use tar.gz format
+              tar czvf \
+                build/mq-${{ github.event.inputs.release_tag }}-${target}.tar.gz \
+                -C build/${target} mq
+            fi
           done
 
       - name: Create GH release and upload binary
@@ -78,4 +98,4 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           gh release create --target ${{ github.ref }}  \
-            ${{ github.event.inputs.release_tag }} ./build/*.tar.gz --generate-notes
+            ${{ github.event.inputs.release_tag }} ./build/*.{tar.gz,zip} --generate-notes
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7223fbb..946a2da 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -43,10 +43,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Trunk Code Quality
         uses: trunk-io/trunk-action@v1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}