diff --git a/scripts/bash/cli.sh b/scripts/bash/cli.sh
index 4472c07..48bf59b 100644
--- a/scripts/bash/cli.sh
+++ b/scripts/bash/cli.sh
@@ -179,9 +179,20 @@ script_self_update() {
   fi
 }
 
+strip_quarantine() {
+  # macOS Gatekeeper refuses to run binaries carrying the com.apple.quarantine
+  # attribute unless they are Developer ID signed and notarized. Some managed
+  # environments (MDM/security tooling) stamp this attribute on network-written
+  # files, which blocks the downloaded CLI with no "Allow Anyway" option. Strip
+  # it if present. No-op on non-macOS and when the attribute is absent.
+  if [[ "$OS" == "macos" ]] && command -v xattr >/dev/null 2>&1; then
+    xattr -d com.apple.quarantine "$BINARY_PATH" 2>/dev/null || true
+  fi
+}
+
 download_binary() {
   curl -R -z "$BINARY_ZIP_PATH" -L "https://api.browserstack.com/sdk/v1/download_cli?os=${OS}&os_arch=${ARCH}" -o "$BINARY_ZIP_PATH"
-  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0775 "$BINARY_PATH"
+  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0755 "$BINARY_PATH" && strip_quarantine
 }
 
 # Self-update is opt-in (DEVA11Y-475): it runs only via the explicit `self-update`
diff --git a/scripts/bash/cli.sh.sha256 b/scripts/bash/cli.sh.sha256
index f6165bd..f898cc6 100644
--- a/scripts/bash/cli.sh.sha256
+++ b/scripts/bash/cli.sh.sha256
@@ -1 +1 @@
-e233e16b32a0ec18d24acf32e8c415d26c4eeecdc287452117fe51de2f4791dc  cli.sh
+2dc6f5c62109ff1ae5185c417ea3896e4bb9f326ce91764e87161d1d27f976fb  cli.sh
diff --git a/scripts/fish/cli.sh b/scripts/fish/cli.sh
index a069b36..c1db097 100644
--- a/scripts/fish/cli.sh
+++ b/scripts/fish/cli.sh
@@ -191,9 +191,20 @@ script_self_update() {
   fi
 }
 
+strip_quarantine() {
+  # macOS Gatekeeper refuses to run binaries carrying the com.apple.quarantine
+  # attribute unless they are Developer ID signed and notarized. Some managed
+  # environments (MDM/security tooling) stamp this attribute on network-written
+  # files, which blocks the downloaded CLI with no "Allow Anyway" option. Strip
+  # it if present. No-op on non-macOS and when the attribute is absent.
+  if [[ "$OS" == "macos" ]] && command -v xattr >/dev/null 2>&1; then
+    xattr -d com.apple.quarantine "$BINARY_PATH" 2>/dev/null || true
+  fi
+}
+
 download_binary() {
   curl -R -z "$BINARY_ZIP_PATH" -L "https://api.browserstack.com/sdk/v1/download_cli?os=${OS}&os_arch=${ARCH}" -o "$BINARY_ZIP_PATH"
-  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0775 "$BINARY_PATH"
+  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0755 "$BINARY_PATH" && strip_quarantine
 }
 
 # Self-update is opt-in (DEVA11Y-475): it runs only via the explicit `self-update`
diff --git a/scripts/fish/cli.sh.sha256 b/scripts/fish/cli.sh.sha256
index 1a6478f..480886b 100644
--- a/scripts/fish/cli.sh.sha256
+++ b/scripts/fish/cli.sh.sha256
@@ -1 +1 @@
-332c8583f95291bf72ac4199702697656d28f5b98eba3a6a724a0272ecf77f83  cli.sh
+6a83801b611b3550f46c91daeaeaa8233644d8edd0092e4dfd92098d268e63d4  cli.sh
diff --git a/scripts/zsh/cli.sh b/scripts/zsh/cli.sh
index 8d11b0e..af319e4 100644
--- a/scripts/zsh/cli.sh
+++ b/scripts/zsh/cli.sh
@@ -190,9 +190,20 @@ script_self_update() {
   fi
 }
 
+strip_quarantine() {
+  # macOS Gatekeeper refuses to run binaries carrying the com.apple.quarantine
+  # attribute unless they are Developer ID signed and notarized. Some managed
+  # environments (MDM/security tooling) stamp this attribute on network-written
+  # files, which blocks the downloaded CLI with no "Allow Anyway" option. Strip
+  # it if present. No-op on non-macOS and when the attribute is absent.
+  if [[ "$OS" == "macos" ]] && command -v xattr >/dev/null 2>&1; then
+    xattr -d com.apple.quarantine "$BINARY_PATH" 2>/dev/null || true
+  fi
+}
+
 download_binary() {
   curl -R -z "$BINARY_ZIP_PATH" -L "https://api.browserstack.com/sdk/v1/download_cli?os=${OS}&os_arch=${ARCH}" -o "$BINARY_ZIP_PATH"
-  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0775 "$BINARY_PATH"
+  bsdtar -xvf "$BINARY_ZIP_PATH" -O > "$BINARY_PATH" && chmod 0755 "$BINARY_PATH" && strip_quarantine
 }
 
 # Self-update is opt-in (DEVA11Y-475): it runs only via the explicit `self-update`
diff --git a/scripts/zsh/cli.sh.sha256 b/scripts/zsh/cli.sh.sha256
index 445f73c..912f7f7 100644
--- a/scripts/zsh/cli.sh.sha256
+++ b/scripts/zsh/cli.sh.sha256
@@ -1 +1 @@
-67edf6abb80741b1f723f07533448288de7652aba859499d287672e8c6c299b4  cli.sh
+0f6344ba1db459bfa34bde971294215e883649e3107842cb585accf83349c462  cli.sh