diff --git a/.github/workflows/ios.yml b/.github/workflows/ios.yml
index 4459564..a3428ef 100644
--- a/.github/workflows/ios.yml
+++ b/.github/workflows/ios.yml
@@ -22,7 +22,17 @@ jobs:
           extra_nix_config: experimental-features = nix-command flakes flake-self-attrs
 
       - name: Build app
-        run: nix develop --command bash -c "flutter pub get && dart scripts/generate.dart && flutter pub run build_runner build && flutter build ios --release --no-codesign"
+        run: |
+          nix develop --command bash -c '
+            set -e
+            flutter pub get
+            dart scripts/generate.dart
+            flutter pub run build_runner build
+            # Nix-provided Flutter'"'"'s bundled frameworks are read-only, which
+            # breaks lipo when Flutter thins them into build/ (NixOS/nixpkgs#405066).
+            find "$(dirname "$(dirname "$(readlink -f "$(command -v flutter)")")")" -type d -iname "*.framework" -exec chmod -R u+w {} + 2>/dev/null || true
+            flutter build ios --release --no-codesign
+          '
 
       # Unsigned IPA: SideStore/AltStore re-sign this on-device with the
       # user's own Apple ID at install time, so no certificate is needed here.
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index e7040fa..65e2060 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -22,7 +22,17 @@ jobs:
           extra_nix_config: experimental-features = nix-command flakes flake-self-attrs
 
       - name: Build app
-        run: nix develop --command bash -c "flutter pub get && dart scripts/generate.dart && flutter pub run build_runner build && flutter build macos --release"
+        run: |
+          nix develop --command bash -c '
+            set -e
+            flutter pub get
+            dart scripts/generate.dart
+            flutter pub run build_runner build
+            # Nix-provided Flutter'"'"'s bundled frameworks are read-only, which
+            # breaks lipo when Flutter thins them into build/ (NixOS/nixpkgs#405066).
+            find "$(dirname "$(dirname "$(readlink -f "$(command -v flutter)")")")" -type d -iname "*.framework" -exec chmod -R u+w {} + 2>/dev/null || true
+            flutter build macos --release
+          '
 
       - name: Upload installer artifact
         uses: actions/upload-artifact@v6