diff --git a/build/build.xml b/build/build.xml
index 27a10ccf5..bc842a6b2 100644
--- a/build/build.xml
+++ b/build/build.xml
@@ -672,16 +672,26 @@
       <fileset file="shared/changes.md" />
     </copy>
 
+    <!-- Can't use this method since the appbundler builds have split:
+         we have a fat binary on aarch64 that has a broken x86_64 build,
+         and the x86_64 version has no aarch64 build at all.
+         For 4.0, this is being copied manually. -->
     <!-- Use the Processing executable as the stub for exported apps.
          This works b/c everything app-specific is in Info.plist. -->
+    <!--
     <property name="app.stub"
               value="${contents.dir}/Java/modes/java/application/mac-app-stub" />
+    -->
     <!-- Grab a copy of the stub binary before it is signed.
          (See processing.mode.java.JavaBuild for usage.)
          Prevents signing errors with exported apps. -->
+    <!--
     <copy file="${contents.dir}/MacOS/Processing" tofile="${app.stub}" />
+    -->
     <!-- The ant copy command does not preserve permissions. -->
+    <!--
     <chmod file="${app.stub}" perm="ugo+x" />
+    -->
 
     <antcall target="assemble">
       <param name="target.path" value="${contents.dir}/Java" />
diff --git a/java/application/stub-macos-aarch64 b/java/application/stub-macos-aarch64
new file mode 100755
index 000000000..1b4f8366d
Binary files /dev/null and b/java/application/stub-macos-aarch64 differ
diff --git a/java/application/stub-macos-x86_64 b/java/application/stub-macos-x86_64
new file mode 100755
index 000000000..4bb20e331
Binary files /dev/null and b/java/application/stub-macos-x86_64 differ
diff --git a/java/src/processing/mode/java/JavaBuild.java b/java/src/processing/mode/java/JavaBuild.java
index 417ec6d56..65dad8cad 100644
--- a/java/src/processing/mode/java/JavaBuild.java
+++ b/java/src/processing/mode/java/JavaBuild.java
@@ -710,8 +710,14 @@ public class JavaBuild {
       File macosFolder = new File(contentsFolder, "MacOS");
       macosFolder.mkdirs();
       // This is an unsigned copy of the app binary (see build/build.xml)
-      Util.copyFile(mode.getContentFile("application/mac-app-stub"),
-                    new File(contentsFolder, "MacOS/" + sketch.getMainName()));
+      File stubFile =
+        mode.getContentFile("application/stub-" + exportVariant);
+      File execFile =
+        new File(contentsFolder, "MacOS/" + sketch.getMainName());
+      Util.copyFile(stubFile, execFile);
+      if (!execFile.setExecutable(true)) {
+        throw new IOException("Could not make " + execFile + " executable.");
+      }
 
       File pkgInfo = new File(contentsFolder, "PkgInfo");
       PrintWriter writer = PApplet.createWriter(pkgInfo);
@@ -908,12 +914,17 @@ public class JavaBuild {
       pw.close();
 
       // attempt to code sign if the Xcode tools appear to be installed
-      if (Platform.isMacOS() && isXcodeInstalled()) {
-        if (embedJava) {
-          ProcessHelper.ffs("codesign", "--force", "--sign", "-", jdkPath);
+      String appPath = dotAppFolder.getAbsolutePath();
+      if (Platform.isMacOS()) {
+        if (isXcodeInstalled()) {
+//        if (embedJava) {
+//          ProcessHelper.ffs("codesign", "--force", "--sign", "--deep", "-", jdkPath);
+//        }
+          ProcessHelper.ffs("codesign", "--force", "--deep", "--sign", "-", appPath);
+        } else {
+          System.err.println("Xcode not installed, install it and manually sign this app:");
+          System.err.println("codesign --force --deep --sign - " + appPath);
         }
-        String appPath = dotAppFolder.getAbsolutePath();
-        ProcessHelper.ffs("codesign", "--force", "--sign", "-", appPath);
       }
 
     } else if (exportPlatform == PConstants.WINDOWS) {
@@ -1078,13 +1089,15 @@ public class JavaBuild {
 
   static protected boolean isXcodeInstalled() {
     if (xcodeInstalled == null) {
+      // Note that this is *not* an xcrun tool, because it's part of the OS.
+      // pkgutil --file-info /usr/bin/xcode-select
+      // https://stackoverflow.com/a/32752859/18247494
+      StringList stdout = new StringList();
+      StringList stderr = new StringList();
+      int result = PApplet.exec(stdout, stderr, "/usr/bin/xcode-select", "-p");
+
+      // Returns 0 if installed, 2 if not (-1 if exception)
       // http://stackoverflow.com/questions/15371925
-      Process p = PApplet.launch("xcode-select", "-p");
-      int result = -1;
-      try {
-        result = p.waitFor();
-      } catch (InterruptedException ignored) { }
-      // returns 0 if installed, 2 if not (-1 if exception)
       xcodeInstalled = (result == 0);
     }
     return xcodeInstalled;
diff --git a/todo.txt b/todo.txt
index 875a0353e..b809171c2 100755
--- a/todo.txt
+++ b/todo.txt
@@ -16,6 +16,8 @@ X   working on macOS, written up for Windows and Linux
 X   test on Windows and Linux
 X working on an updated welcome screen
 X fix usages of .array() method in PDE code
+X get code signing to work again on macOS for exported applications
+X   absolutely floored that it was broken this long
 
 docs
 X update theme instructions
@@ -254,6 +256,8 @@ _   https://github.com/processing/processing/wiki/troubleshooting
 _   and update the Help menu to link to it
 _   and maybe the FAQ too?
 
+lipo stub-aarch64-fat -remove x86_64 -output stub-aarch64
+
 
 4.0 / with Casey
 _ what things do we want to call out for the release?