diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1728a346..9593e87f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -197,7 +197,7 @@ jobs:
       - name: Fixup Permissions
         run: find UTM-macos-universal/UTM.xcarchive -type f \( -path '*/Contents/MacOS/*' -or -path '*/Frameworks/*.dylib' \) -exec chmod +x \{\} \;
       - name: Package for Release
-        run: ./scripts/package_mac.sh UTM-macos-universal/UTM.xcarchive . "$SIGNING_TEAM_ID" "$PROFILE_UUID"
+        run: ./scripts/package_mac.sh developer-id UTM-macos-universal/UTM.xcarchive . "$SIGNING_TEAM_ID" "$PROFILE_UUID"
         env:
           SIGNING_TEAM_ID: ${{ secrets.SIGNING_TEAM_ID }}
           PROFILE_UUID: ${{ secrets.PROFILE_UUID }}
diff --git a/scripts/package_mac.sh b/scripts/package_mac.sh
index a7471889..35fc9046 100755
--- a/scripts/package_mac.sh
+++ b/scripts/package_mac.sh
@@ -7,18 +7,22 @@ command -v realpath >/dev/null 2>&1 || realpath() {
 }
 BASEDIR="$(dirname "$(realpath $0)")"
 
-if [ $# -lt 2 ]; then
-	echo "usage: $0 UTM.xcarchive outputPath [TEAM_ID PROFILE_NAME]"
-	echo "  uses ad-hoc signing if TEAM_ID and PROFILE_NAME is missing"
-	echo "  uses distribution signing if both TEAM_ID and PROFILE_NAME are specified"
+if [ $# -lt 3 ]; then
+	echo "usage: $0 MODE UTM.xcarchive outputPath [TEAM_ID PROFILE_NAME]"
+	echo "  MODE is one of:"
+	echo "          unsigned (unsigned DMG)"
+	echo "          developer-id (signed DMG)"
+	echo "          app-store (Mac App Store package)"
+	echo "  TEAM_ID is required if not unsigned"
+	echo "  PROFILE_NAME is required if not unsigned, can be the name or UUID"
 	exit 1
 fi
 
-INPUT=$1
-OUTPUT=$2
-TEAM_ID=$3
-PROFILE_NAME=$4
-DISTRIBUTION=0
+MODE=$1
+INPUT=$2
+OUTPUT=$3
+TEAM_ID=$4
+PROFILE_NAME=$5
 OPTIONS="/tmp/options.plist"
 SIGNED="/tmp/signed"
 UTM_ENTITLEMENTS="/tmp/utm.entitlements"
@@ -26,13 +30,6 @@ LAUNCHER_ENTITLEMENTS="/tmp/launcher.entitlements"
 HELPER_ENTITLEMENTS="/tmp/helper.entitlements"
 INPUT_COPY="/tmp/UTM.xcarchive"
 
-if [ ! -z "$TEAM_ID" -a -z "$PROFILE_NAME" ]; then
-	echo "You must specify a provisioning profile name for distribution signing!"
-	exit 1
-elif [ ! -z "$TEAM_ID" -a ! -z "$PROFILE_NAME" ]; then
-	DISTRIBUTION=1
-fi
-
 cat >"$OPTIONS" <<EOL
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -40,8 +37,10 @@ cat >"$OPTIONS" <<EOL
 <dict>
 	<key>compileBitcode</key>
 	<false/>
+	<key>installerSigningCertificate</key>
+	<string>3rd Party Mac Developer Installer</string>
 	<key>method</key>
-	<string>developer-id</string>
+	<string>${MODE}</string>
 	<key>provisioningProfiles</key>
 	<dict>
 		<key>com.utmapp.UTM</key>
@@ -63,7 +62,7 @@ cp "$BASEDIR/../Platform/macOS/macOS.entitlements" "$UTM_ENTITLEMENTS"
 cp "$BASEDIR/../QEMULauncher/QEMULauncher.entitlements" "$LAUNCHER_ENTITLEMENTS"
 cp "$BASEDIR/../QEMUHelper/QEMUHelper.entitlements" "$HELPER_ENTITLEMENTS"
 
-if [ $DISTRIBUTION -eq 0 ]; then
+if [ "$MODE" == "unsigned" ]; then
 	/usr/libexec/PlistBuddy -c "Delete :com.apple.vm.device-access" "$UTM_ENTITLEMENTS"
 	/usr/libexec/PlistBuddy -c "Add :com.apple.security.cs.disable-library-validation bool true" "$UTM_ENTITLEMENTS"
 	/usr/libexec/PlistBuddy -c "Add :com.apple.security.cs.disable-library-validation bool true" "$LAUNCHER_ENTITLEMENTS"
@@ -80,7 +79,7 @@ codesign --force --sign - --entitlements "$HELPER_ENTITLEMENTS" --timestamp=none
 codesign --force --sign - --entitlements "$UTM_ENTITLEMENTS" --timestamp=none --options runtime "$INPUT_COPY/Products/Applications/UTM.app/Contents/MacOS/UTM"
 
 # re-sign with certificate and profile if requested
-if [ $DISTRIBUTION -eq 0 ]; then
+if [ "$MODE" == "unsigned" ]; then
 	mv "$INPUT_COPY/Products/Applications" "$SIGNED"
 else
 	xcodebuild -exportArchive -exportOptionsPlist "$OPTIONS" -archivePath "$INPUT_COPY" -exportPath "$SIGNED"
@@ -92,6 +91,10 @@ rm "$LAUNCHER_ENTITLEMENTS"
 rm "$HELPER_ENTITLEMENTS"
 rm -rf "$INPUT_COPY"
 
-rm -f "$OUTPUT/UTM.dmg"
-hdiutil create -fs HFS+ -srcfolder "$SIGNED/UTM.app" -volname "UTM" "$OUTPUT/UTM.dmg"
+if [ "$MODE" == "app-store" ]; then
+	cp "$SIGNED/UTM.pkg" "$OUTPUT/UTM.pkg"
+else
+	rm -f "$OUTPUT/UTM.dmg"
+	hdiutil create -fs HFS+ -srcfolder "$SIGNED/UTM.app" -volname "UTM" "$OUTPUT/UTM.dmg"
+fi
 rm -rf "$SIGNED"