diff --git a/Scripts/release.sh b/Scripts/release.sh
index 11632de..70465a2 100755
--- a/Scripts/release.sh
+++ b/Scripts/release.sh
@@ -6,8 +6,10 @@ command -v xcodebuild >/dev/null || { echo "Xcode is required" >&2; exit 1; }
 command -v hdiutil >/dev/null || { echo "hdiutil missing" >&2; exit 1; }
 IDENTITY="${SIGNING_IDENTITY:-$(security find-identity -v -p codesigning | sed -nE 's/.*"(Developer ID Application: [^"]+)".*/\1/p' | head -1)}"
 [[ -n "$IDENTITY" ]] || { echo "Developer ID Application signing identity required. Set SIGNING_IDENTITY." >&2; exit 1; }
-PROFILE="${NOTARY_PROFILE:-}"
-[[ -n "$PROFILE" ]] || { echo "Set NOTARY_PROFILE to an existing notarytool keychain profile." >&2; exit 1; }
+# Use the existing Apple notarization profile by default.
+# Override with NOTARY_PROFILE when required.
+PROFILE="${NOTARY_PROFILE:-orion-notary}"
+echo "Notarization profile: $PROFILE"
 DERIVED="$ROOT/.build"
 xcodebuild -project "$ROOT/PHPGuard.xcodeproj" -scheme PHPGuard -configuration Release -derivedDataPath "$DERIVED" CODE_SIGNING_ALLOWED=NO build
 APP="$DERIVED/Build/Products/Release/PHPGuard.app"
diff --git a/Scripts/release.sh.backup-20261022-130947 b/Scripts/release.sh.backup-20261022-130947
new file mode 100755
index 0000000..11632de
--- /dev/null
+++ b/Scripts/release.sh.backup-20261022-130947
@@ -0,0 +1,36 @@
+#!/bin/zsh
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+command -v xcodebuild >/dev/null || { echo "Xcode is required" >&2; exit 1; }
+command -v hdiutil >/dev/null || { echo "hdiutil missing" >&2; exit 1; }
+IDENTITY="${SIGNING_IDENTITY:-$(security find-identity -v -p codesigning | sed -nE 's/.*"(Developer ID Application: [^"]+)".*/\1/p' | head -1)}"
+[[ -n "$IDENTITY" ]] || { echo "Developer ID Application signing identity required. Set SIGNING_IDENTITY." >&2; exit 1; }
+PROFILE="${NOTARY_PROFILE:-}"
+[[ -n "$PROFILE" ]] || { echo "Set NOTARY_PROFILE to an existing notarytool keychain profile." >&2; exit 1; }
+DERIVED="$ROOT/.build"
+xcodebuild -project "$ROOT/PHPGuard.xcodeproj" -scheme PHPGuard -configuration Release -derivedDataPath "$DERIVED" CODE_SIGNING_ALLOWED=NO build
+APP="$DERIVED/Build/Products/Release/PHPGuard.app"
+[[ -d "$APP" ]] || { echo "Missing Release app" >&2; exit 1; }
+VERSION="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$APP/Contents/Info.plist")"
+mkdir -p "$ROOT/dist"
+STAGING="$(mktemp -d)"
+trap 'rm -rf "$STAGING"' EXIT
+cp -R "$APP" "$STAGING/PHPGuard.app"
+# No --deep signing: sign embedded executables individually if added in future.
+codesign --force --options runtime --timestamp --sign "$IDENTITY" "$STAGING/PHPGuard.app"
+codesign --verify --strict --verbose=2 "$STAGING/PHPGuard.app"
+DMG="$ROOT/dist/PHPGuard-$VERSION.dmg"
+rm -f "$DMG"
+ln -s /Applications "$STAGING/Applications"
+# Include a branded installer graphic in the disk image.
+INSTALLER_ICON="$ROOT/PHPGuard/Assets.xcassets/InstallerIcon.imageset/icon.png"
+if [[ -f "$INSTALLER_ICON" ]]; then
+  mkdir -p "$STAGING/.background"
+  cp "$INSTALLER_ICON" "$STAGING/.background/PHPGuard-Installer.png"
+fi
+hdiutil create -volname "PHPGuard $VERSION" -srcfolder "$STAGING" -ov -format UDZO "$DMG"
+xcrun notarytool submit "$DMG" --keychain-profile "$PROFILE" --wait
+xcrun stapler staple "$DMG"
+xcrun stapler validate "$DMG"
+echo "Release ready: $DMG"