diff --git a/scripts/codesign-mac-app.sh b/scripts/codesign-mac-app.sh
index ca9ca0e93..ab0a1292f 100755
--- a/scripts/codesign-mac-app.sh
+++ b/scripts/codesign-mac-app.sh
@@ -125,6 +125,9 @@ if [ -d "$APP_BUNDLE/Contents/Resources/Relay" ]; then
   find "$APP_BUNDLE/Contents/Resources/Relay" -type f \( -name "*.node" -o -name "*.dylib" \) -print0 | while IFS= read -r -d '' f; do
     echo "Signing gateway payload: $f"; sign_item "$f" "$ENT_TMP_BASE"
   done
+  if [ -f "$APP_BUNDLE/Contents/Resources/Relay/clawdis-gateway" ]; then
+    echo "Signing embedded gateway"; sign_item "$APP_BUNDLE/Contents/Resources/Relay/clawdis-gateway" "$ENT_TMP_BASE"
+  fi
 fi
 
 # Sign Sparkle deeply if present
diff --git a/scripts/package-mac-app.sh b/scripts/package-mac-app.sh
index 0b7c26df7..593dd2536 100755
--- a/scripts/package-mac-app.sh
+++ b/scripts/package-mac-app.sh
@@ -128,56 +128,46 @@ cp "$ROOT_DIR/apps/macos/Sources/Clawdis/Resources/Clawdis.icns" "$APP_ROOT/Cont
 RELAY_DIR="$APP_ROOT/Contents/Resources/Relay"
 
 if [[ "${SKIP_GATEWAY_PACKAGE:-0}" != "1" ]]; then
-  echo "🧰 Staging gateway payload (dist + node_modules; expects system Node ≥22)"
-  rsync -a --delete --exclude "Clawdis.app" "$ROOT_DIR/dist/" "$RELAY_DIR/dist/"
-  cp "$ROOT_DIR/package.json" "$RELAY_DIR/"
-  cp "$ROOT_DIR/pnpm-lock.yaml" "$RELAY_DIR/"
-  if [ -f "$ROOT_DIR/.npmrc" ]; then
-    cp "$ROOT_DIR/.npmrc" "$RELAY_DIR/"
+  if ! command -v bun >/dev/null 2>&1; then
+    echo "ERROR: bun missing. Install bun to package the embedded gateway." >&2
+    exit 1
   fi
 
-  echo "📦 Installing prod node_modules into bundle via temp project"
-  TMP_DEPLOY=$(mktemp -d /tmp/clawdis-deps.XXXXXX)
-  cp "$ROOT_DIR/package.json" "$TMP_DEPLOY/"
-  cp "$ROOT_DIR/pnpm-lock.yaml" "$TMP_DEPLOY/"
-  [ -f "$ROOT_DIR/.npmrc" ] && cp "$ROOT_DIR/.npmrc" "$TMP_DEPLOY/"
-  PNPM_STORE_DIR="$TMP_DEPLOY/.pnpm-store" \
-  PNPM_HOME="$HOME/Library/pnpm" \
-  pnpm install \
-    --prod \
-    --force \
-    --no-frozen-lockfile \
-    --ignore-scripts=false \
-    --config.enable-pre-post-scripts=true \
-    --config.ignore-workspace-root-check=true \
-    --config.shared-workspace-lockfile=false \
-    --config.node-linker=hoisted \
-    --lockfile-dir "$TMP_DEPLOY" \
-    --dir "$TMP_DEPLOY"
-  PNPM_STORE_DIR="$TMP_DEPLOY/.pnpm-store" \
-  PNPM_HOME="$HOME/Library/pnpm" \
-  pnpm rebuild sharp --config.ignore-workspace-root-check=true --dir "$TMP_DEPLOY"
-  rsync -a "$TMP_DEPLOY/node_modules/" "$RELAY_DIR/node_modules/"
+  echo "🧰 Building bundled gateway (bun --compile)"
+  mkdir -p "$RELAY_DIR"
+  BUN_OUT="$RELAY_DIR/clawdis-gateway"
+  bun build "$ROOT_DIR/dist/macos/gateway-daemon.js" \
+    --compile \
+    --outfile "$BUN_OUT" \
+    -e playwright-core \
+    -e electron \
+    -e "chromium-bidi*" \
+    --define "__CLAWDIS_VERSION__=\\\"$PKG_VERSION\\\""
+  chmod +x "$BUN_OUT"
 
-  # Keep only the arm64 macOS sharp vendor payloads to shrink the bundle
-  SHARP_VENDOR_DIR="$RELAY_DIR/node_modules/@img"
-  if [ -d "$SHARP_VENDOR_DIR" ]; then
-    find "$SHARP_VENDOR_DIR" -maxdepth 1 -type d -name "sharp-*" \
-      ! -name "sharp-darwin-arm64" \
-      ! -name "sharp-libvips-darwin-arm64" -exec rm -rf {} +
+  echo "📄 Writing embedded runtime package.json (Pi compatibility)"
+  cat > "$RELAY_DIR/package.json" <<JSON
+{
+  "name": "clawdis-embedded",
+  "version": "$PKG_VERSION",
+  "piConfig": {
+    "name": "pi",
+    "configDir": ".pi"
+  }
+}
+JSON
+
+  echo "🎨 Copying Pi theme payload (optional)"
+  PI_ENTRY_URL="$(cd "$ROOT_DIR" && node --input-type=module -e "console.log(import.meta.resolve('@mariozechner/pi-coding-agent'))")"
+  PI_ENTRY="$(cd "$ROOT_DIR" && node --input-type=module -e "console.log(new URL(process.argv[1]).pathname)" "$PI_ENTRY_URL")"
+  PI_DIR="$(cd "$(dirname "$PI_ENTRY")/.." && pwd)"
+  THEME_SRC="$PI_DIR/dist/modes/interactive/theme"
+  if [ -d "$THEME_SRC" ]; then
+    rm -rf "$RELAY_DIR/theme"
+    cp -R "$THEME_SRC" "$RELAY_DIR/theme"
+  else
+    echo "WARN: Pi theme dir missing at $THEME_SRC (continuing)" >&2
   fi
-
-  # Prune obvious dev/build tooling to keep size down
-  rm -rf \
-    "$RELAY_DIR/node_modules/.bin"/vite \
-    "$RELAY_DIR/node_modules/.bin"/rolldown \
-    "$RELAY_DIR/node_modules/.bin"/biome \
-    "$RELAY_DIR/node_modules/.bin"/vitest \
-    "$RELAY_DIR/node_modules/.bin"/tsc \
-    "$RELAY_DIR/node_modules/.bin"/tsx 2>/dev/null || true
-  rm -rf \
-    "$RELAY_DIR/node_modules"/{vite,rolldown,vitest,ts-node,ts-node-dev,typescript,@types,docx-preview,jszip,lucide,ollama} 2>/dev/null || true
-  rm -rf "$TMP_DEPLOY"
 else
   echo "🧰 Skipping gateway payload packaging (SKIP_GATEWAY_PACKAGE=1)"
 fi