diff --git a/.github/actions/configure-docker/action.yml b/.github/actions/configure-docker/action.yml
index fc014156590..e45d26ee232 100644
--- a/.github/actions/configure-docker/action.yml
+++ b/.github/actions/configure-docker/action.yml
@@ -20,7 +20,7 @@ runs:
         esac
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@v4
       with:
         # Use host network to allow access to cirrus gha cache running on the host
         driver-opts: |
@@ -28,7 +28,7 @@ runs:
 
     # This is required to allow buildkit to access the actions cache
     - name: Expose actions cache variables
-      uses: actions/github-script@v6
+      uses: actions/github-script@v8
       with:
         script: |
           Object.keys(process.env).forEach(function (key) {
diff --git a/.github/actions/restore-caches/action.yml b/.github/actions/restore-caches/action.yml
index 8dc35d4902e..21f2807f4c7 100644
--- a/.github/actions/restore-caches/action.yml
+++ b/.github/actions/restore-caches/action.yml
@@ -5,7 +5,7 @@ runs:
   steps:
     - name: Restore Ccache cache
       id: ccache-cache
-      uses: cirruslabs/cache/restore@v4
+      uses: cirruslabs/cache/restore@v5
       with:
         path: ${{ env.CCACHE_DIR }}
         key: ccache-${{ env.CONTAINER_NAME }}-${{ github.run_id }}
@@ -14,7 +14,7 @@ runs:
 
     - name: Restore depends sources cache
       id: depends-sources
-      uses: cirruslabs/cache/restore@v4
+      uses: cirruslabs/cache/restore@v5
       with:
         path: ${{ env.SOURCES_PATH }}
         key: depends-sources-${{ env.CONTAINER_NAME }}-${{ env.DEPENDS_HASH }}
@@ -23,7 +23,7 @@ runs:
 
     - name: Restore built depends cache
       id: depends-built
-      uses: cirruslabs/cache/restore@v4
+      uses: cirruslabs/cache/restore@v5
       with:
         path: ${{ env.BASE_CACHE }}
         key: depends-built-${{ env.CONTAINER_NAME }}-${{ env.DEPENDS_HASH }}
@@ -32,7 +32,7 @@ runs:
 
     - name: Restore previous releases cache
       id: previous-releases
-      uses: cirruslabs/cache/restore@v4
+      uses: cirruslabs/cache/restore@v5
       with:
         path: ${{ env.PREVIOUS_RELEASES_DIR }}
         key: previous-releases-${{ env.CONTAINER_NAME }}-${{ env.PREVIOUS_RELEASES_HASH }}
diff --git a/.github/actions/save-caches/action.yml b/.github/actions/save-caches/action.yml
index 0e3b31246c6..3072ab3f224 100644
--- a/.github/actions/save-caches/action.yml
+++ b/.github/actions/save-caches/action.yml
@@ -11,28 +11,28 @@ runs:
         echo "previous releases direct cache hit to primary key: ${{ env.previous-releases-cache-hit }}"
 
     - name: Save Ccache cache
-      uses: cirruslabs/cache/save@v4
+      uses: cirruslabs/cache/save@v5
       if: ${{ (github.event_name == 'push') && (github.ref_name == github.event.repository.default_branch) }}
       with:
         path: ${{ env.CCACHE_DIR }}
         key: ccache-${{ env.CONTAINER_NAME }}-${{ github.run_id }}
 
     - name: Save depends sources cache
-      uses: cirruslabs/cache/save@v4
+      uses: cirruslabs/cache/save@v5
       if: ${{ (github.event_name == 'push') && (github.ref_name == github.event.repository.default_branch) && (env.depends-sources-cache-hit != 'true') }}
       with:
         path: ${{ env.SOURCES_PATH }}
         key: depends-sources-${{ env.CONTAINER_NAME }}-${{ env.DEPENDS_HASH }}
 
     - name: Save built depends cache
-      uses: cirruslabs/cache/save@v4
+      uses: cirruslabs/cache/save@v5
       if: ${{ (github.event_name == 'push') && (github.ref_name == github.event.repository.default_branch) && (env.depends-built-cache-hit != 'true' )}}
       with:
         path: ${{ env.BASE_CACHE }}
         key: depends-built-${{ env.CONTAINER_NAME }}-${{ env.DEPENDS_HASH }}
 
     - name: Save previous releases cache
-      uses: cirruslabs/cache/save@v4
+      uses: cirruslabs/cache/save@v5
       if: ${{ (github.event_name == 'push') && (github.ref_name == github.event.repository.default_branch) && (env.previous-releases-cache-hit != 'true' )}}
       with:
         path: ${{ env.PREVIOUS_RELEASES_DIR }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 32b2e6d6f20..59403bd3b16 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -167,7 +167,7 @@ jobs:
 
       - name: Restore Ccache cache
         id: ccache-cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           path: ${{ env.CCACHE_DIR }}
           key: ${{ github.job }}-${{ matrix.job-type }}-ccache-${{ github.run_id }}
@@ -179,7 +179,7 @@ jobs:
           FILE_ENV: ${{ matrix.file-env }}
 
       - name: Save Ccache cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         if: github.event_name != 'pull_request' && steps.ccache-cache.outputs.cache-hit != 'true'
         with:
           path: ${{ env.CCACHE_DIR }}
@@ -246,7 +246,7 @@ jobs:
           key: ${{ github.job }}-vcpkg-tools
 
       - name: Restore vcpkg binary cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         id: vcpkg-binary-cache
         with:
           path: ~/AppData/Local/vcpkg/archives
@@ -257,7 +257,7 @@ jobs:
           cmake -B build -Werror=dev --preset vs2022 -DCMAKE_TOOLCHAIN_FILE="${VCPKG_INSTALLATION_ROOT}/scripts/buildsystems/vcpkg.cmake" ${{ matrix.generate-options }}
 
       - name: Save vcpkg binary cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         if: github.event_name != 'pull_request' && steps.vcpkg-binary-cache.outputs.cache-hit != 'true' && matrix.job-type == 'standard'
         with:
           path: ~/AppData/Local/vcpkg/archives
@@ -358,7 +358,7 @@ jobs:
         uses: ./.github/actions/save-caches
 
       - name: Upload built executables
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: x86_64-w64-mingw32-executables-${{ github.run_id }}
           path: |
@@ -380,7 +380,7 @@ jobs:
       - *CHECKOUT
 
       - name: Download built executables
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: x86_64-w64-mingw32-executables-${{ github.run_id }}
 
diff --git a/ci/test/03_test_script.sh b/ci/test/03_test_script.sh
index 7a1e7f32133..16d1f1cd462 100755
--- a/ci/test/03_test_script.sh
+++ b/ci/test/03_test_script.sh
@@ -165,6 +165,14 @@ if [ "$RUN_CHECK_DEPS" = "true" ]; then
   "${BASE_ROOT_DIR}/contrib/devtools/check-deps.sh" "${BASE_BUILD_DIR}"
 fi
 
+if [[ "$CI_OS_NAME" == "macos" && "${GOAL}" = "install deploy" ]]; then
+  unzip "${BASE_BUILD_DIR}/Bitcoin-Core.zip" -d "${BASE_BUILD_DIR}/deploy"
+  if ! ( codesign --verify "${BASE_BUILD_DIR}/deploy/Bitcoin-Qt.app" ); then
+    echo "Codesigning failed."
+    false
+  fi
+fi
+
 if [ "$RUN_UNIT_TESTS" = "true" ]; then
   DIR_UNIT_TEST_DATA="${DIR_UNIT_TEST_DATA}" \
   LD_LIBRARY_PATH="${DEPENDS_DIR}/${HOST}/lib" \
diff --git a/contrib/macdeploy/macdeployqtplus b/contrib/macdeploy/macdeployqtplus
index 802afa5389d..01a723687b5 100755
--- a/contrib/macdeploy/macdeployqtplus
+++ b/contrib/macdeploy/macdeployqtplus
@@ -160,7 +160,7 @@ class DeploymentInfo(object):
 
     def detectQtPath(self, frameworkDirectory: str):
         parentDir = os.path.dirname(frameworkDirectory)
-        if os.path.exists(os.path.join(parentDir, "share", "qt", "translations")):
+        if os.path.exists(os.path.join(parentDir, "share", "qt", "plugins")):
             self.qtPath = parentDir
         else:
             self.qtPath = os.getenv("QTDIR", None)
@@ -499,7 +499,7 @@ if platform.system() == "Darwin":
 # ------------------------------------------------
 
 if config.zip is not None:
-    shutil.make_archive('{}'.format(appname), format='zip', root_dir='dist', base_dir='Bitcoin-Qt.app')
+    subprocess.check_call(["zip", "-ry", os.path.abspath(appname + ".zip"), 'Bitcoin-Qt.app'], cwd='dist')
 
 # ------------------------------------------------
 
diff --git a/doc/release-notes.md b/doc/release-notes.md
index 12eccd1ce58..2147de3985e 100644
--- a/doc/release-notes.md
+++ b/doc/release-notes.md
@@ -65,6 +65,7 @@ Notable changes
 - #34627 guix: use a temporary file over sponge, drop moreutils
 - #34713 depends: Allow building Qt packages after interruption
 - #34754 depends: Qt fixes for GCC 16 compatibility
+- #34787 build: fix native macOS deployment
 
 ### Test
 
@@ -97,6 +98,8 @@ Notable changes
 - #34344 ci: update GitHub Actions versions
 - #34453 ci: Always print low ccache hit rate notice
 - #34461 ci: Print verbose build error message in test-each-commit
+- #34802 ci: Bump GHA actions versions
+- #34815 ci: bump cirruslabs actions versions
 
 Credits
 =======