diff --git a/.github/actions/release_artifacts/action.yml b/.github/actions/release_artifacts/action.yml
index ca44951761..8e14630b4b 100644
--- a/.github/actions/release_artifacts/action.yml
+++ b/.github/actions/release_artifacts/action.yml
@@ -113,7 +113,7 @@ runs:
       run: |
         cat << 'EOF' | tee -a "${GITHUB_OUTPUT}"
         paths<<EOM
-        workspace/contrast-cli/bin/contrast
+        workspace/contrast-x86_64-linux
         workspace/coordinator*.yml
         workspace/runtime-*.yml
         workspace/emojivoto-demo.yml
@@ -182,6 +182,8 @@ runs:
         SET: base
       run: |
         nix build -L ".#${SET}.contrast.cli-release" --out-link workspace/contrast-cli
+        SYSTEM=$(nix eval --raw --impure --expr 'builtins.currentSystem')
+        cp workspace/contrast-cli/bin/contrast "workspace/contrast-${SYSTEM}"
     - name: AWS login (IAM role)
       uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
       with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2bf9222380..4ed3a01f28 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -121,7 +121,7 @@ jobs:
   update-main:
     name: Update main branch
     runs-on: ubuntu-24.04
-    needs: [process-inputs, release]
+    needs: [process-inputs, release, release-aarch64-darwin]
     permissions:
       contents: write
     env:
@@ -182,6 +182,11 @@ jobs:
         with:
           name: contrast-release-artifacts
           path: ./contrast-main
+      - name: Download darwin CLI artifact
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: contrast-cli-aarch64-darwin
+          path: ./contrast-main/workspace
       - name: Update contrast-releases.json with new release
         working-directory: contrast-main
         run: nix run ".#${SET}.scripts.update-contrast-releases"
@@ -217,6 +222,58 @@ jobs:
           token: ${{ secrets.NUNKI_CI_COMMIT_PUSH_PR }}
           path: ./contrast-main
 
+  release-aarch64-darwin:
+    name: Build aarch64-darwin CLI
+    runs-on: macos-latest
+    needs: process-inputs
+    permissions:
+      contents: read
+    env:
+      VERSION: ${{ inputs.version }}
+      SET: base
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ needs.process-inputs.outputs.WORKING_BRANCH }}
+          persist-credentials: false
+      - uses: ./.github/actions/setup_nix
+        with:
+          githubToken: ${{ secrets.GITHUB_TOKEN }}
+          cachixToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - name: Bump flake version to release version
+        uses: ./.github/actions/bump_version
+        with:
+          version: ${{ needs.process-inputs.outputs.WITHOUT_V }}
+          commit: false
+      - name: Build CLI
+        run: |
+          nix build -L ".#${SET}.contrast.cli-release"
+          cp result/bin/contrast contrast-aarch64-darwin
+      - name: Upload artifact
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: contrast-cli-aarch64-darwin
+          path: contrast-aarch64-darwin
+
+  attach-darwin-cli:
+    name: Attach darwin CLI to release
+    runs-on: ubuntu-24.04
+    needs: [release, release-aarch64-darwin]
+    permissions:
+      contents: write
+    env:
+      VERSION: ${{ inputs.version }}
+    steps:
+      - name: Download darwin CLI artifact
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: contrast-cli-aarch64-darwin
+      - name: Attach to release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release upload "${VERSION}" contrast-aarch64-darwin --repo "${{ github.repository }}"
+
   release:
     name: Build and push artifacts, create release
     runs-on: ubuntu-24.04
@@ -401,7 +458,7 @@ jobs:
 
   publish:
     name: Publish release
-    needs: [process-inputs, release, test]
+    needs: [process-inputs, release, test, attach-darwin-cli]
     runs-on: ubuntu-24.04
     environment: release-publish
     permissions:
diff --git a/.github/workflows/test-darwin-cli.yml b/.github/workflows/test-darwin-cli.yml
new file mode 100644
index 0000000000..8ab8e02604
--- /dev/null
+++ b/.github/workflows/test-darwin-cli.yml
@@ -0,0 +1,36 @@
+name: Test darwin CLI build
+
+on:
+  push:
+    branches:
+      - sse/darwin-cli
+
+jobs:
+  build-darwin-cli:
+    name: Build aarch64-darwin CLI
+    runs-on: macos-latest
+    permissions:
+      contents: read
+    env:
+      SET: base
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup_nix
+        with:
+          githubToken: ${{ secrets.GITHUB_TOKEN }}
+          cachixToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - name: Build CLI
+        run: |
+          nix build -L ".#${SET}.contrast.cli-release"
+          cp result/bin/contrast contrast-aarch64-darwin
+      - name: Verify binary
+        run: |
+          file contrast-aarch64-darwin
+          ./contrast-aarch64-darwin --version
+      - name: Upload artifact
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: contrast-cli-aarch64-darwin
+          path: contrast-aarch64-darwin
diff --git a/docs/docs/howto/install-cli.md b/docs/docs/howto/install-cli.md
index 406590b2f0..e5c0f5b887 100644
--- a/docs/docs/howto/install-cli.md
+++ b/docs/docs/howto/install-cli.md
@@ -12,14 +12,33 @@ Required for deploying with Contrast.
 
 ## How-to
 
-Download the Contrast CLI from the latest release:
+Download the Contrast CLI from the latest release and install it in your PATH:
+
+<Tabs queryString="platform">
+<TabItem value="linux" label="Linux (x86_64)">
 
 ```bash
-curl --proto '=https' --tlsv1.2 -fLo contrast https://github.com/edgelesssys/contrast/releases/latest/download/contrast
+curl --proto '=https' --tlsv1.2 -fLo contrast https://github.com/edgelesssys/contrast/releases/latest/download/contrast-x86_64-linux
+sudo install contrast /usr/local/bin/contrast
 ```
 
-After that, install the Contrast CLI in your PATH, e.g.:
+</TabItem>
+<TabItem value="macos" label="macOS (Apple Silicon)">
 
 ```bash
+curl --proto '=https' --tlsv1.2 -fLo contrast https://github.com/edgelesssys/contrast/releases/latest/download/contrast-aarch64-darwin
 sudo install contrast /usr/local/bin/contrast
 ```
+
+:::note
+If you download the binary via a web browser instead of `curl`, macOS may show a warning
+that the software can't be verified. Remove the quarantine attribute to resolve this:
+
+```bash
+sudo xattr -d com.apple.quarantine contrast
+```
+
+:::
+
+</TabItem>
+</Tabs>
diff --git a/packages/update-contrast-releases.sh b/packages/update-contrast-releases.sh
index e3dfdb300d..c866c6f7b5 100755
--- a/packages/update-contrast-releases.sh
+++ b/packages/update-contrast-releases.sh
@@ -31,7 +31,8 @@ target_configs=(
 # declare an associative array that pairs the field name
 # in ./packages/versions.json with the path to the file
 declare -A fields
-fields["contrast"]="./workspace/contrast-cli/bin/contrast"
+fields["contrast"]="./workspace/contrast-x86_64-linux"
+fields["contrast-aarch64-darwin"]="./workspace/contrast-aarch64-darwin"
 fields["coordinator.yml"]="./workspace/coordinator.yml"
 fields["runtime.yml"]="./workspace/runtime.yml"
 fields["emojivoto-demo.zip"]="./workspace/emojivoto-demo.zip"