diff --git a/docs/operations.md b/docs/operations.md
index 7e29f6b..44e80fc 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -30,7 +30,9 @@ The build script embeds the pinned Sparkle framework with its updater and XPC
 services, signs every nested component before the outer app, and verifies the
 result. The package script verifies the app structure, rejects filesystem
 metadata sidecars, mounts the DMG read-only, scans it for build-machine paths,
-and runs DMG integrity verification. The ZIP contains `AgentDock.app` at its
+and runs DMG integrity verification. If `diskutil` cannot create the DMG,
+packaging falls back to `hdiutil` and verifies the resulting image with the same
+privacy and integrity gates. The ZIP contains `AgentDock.app` at its
 root, as required by Sparkle's archive extractor. An ad-hoc local build has no
 Sparkle public key and keeps update checks disabled.
 
diff --git a/script/package_app.sh b/script/package_app.sh
index 26ecbd9..ad46823 100755
--- a/script/package_app.sh
+++ b/script/package_app.sh
@@ -168,13 +168,13 @@ mkdir -p "$DMG_STAGING_DIR"
 /bin/ln -s /Applications "$DMG_STAGING_DIR/Applications"
 
 USE_DISKUTIL_IMAGE=0
-if /usr/sbin/diskutil image create from -help >/dev/null 2>&1; then
-  USE_DISKUTIL_IMAGE=1
-  COPYFILE_DISABLE=1 /usr/sbin/diskutil image create from \
+if /usr/sbin/diskutil image create from -help >/dev/null 2>&1 \
+  && COPYFILE_DISABLE=1 /usr/sbin/diskutil image create from \
     --format UDZO \
     --volumeName "$APP_NAME" \
     "$DMG_STAGING_DIR" \
-    "$DMG_PATH"
+    "$DMG_PATH"; then
+  USE_DISKUTIL_IMAGE=1
 else
   COPYFILE_DISABLE=1 /usr/bin/hdiutil create \
     -volname "$APP_NAME" \