diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 606d8fa..b2847b4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,10 +19,25 @@ jobs:
           xcode-version: '26.3'
 
       - name: Show toolchain
-        run: swift --version
+        run: |
+          xcodebuild -version
+          xcrun --sdk macosx --show-sdk-version
+          swift --version
 
-      - name: Build (debug)
-        run: swift build -v
+      - name: Check whitespace
+        run: git diff --check
+
+      - name: Run tests
+        run: swift test
+
+      - name: Build direct app
+        run: swift build
+
+      - name: Build MAS configuration
+        run: swift build -Xswiftc -DMAS
 
       - name: Build app bundle
         run: VERSION=0.0.0 BUILD=ci ./scripts/build_app.sh
+
+      - name: Verify universal executable
+        run: /usr/bin/lipo packaging/Pesty.app/Contents/MacOS/Pesty -verify_arch arm64 x86_64
diff --git a/Sources/Pesty/Monitor/PasteService.swift b/Sources/Pesty/Monitor/PasteService.swift
index 4645f5f..9621c01 100644
--- a/Sources/Pesty/Monitor/PasteService.swift
+++ b/Sources/Pesty/Monitor/PasteService.swift
@@ -102,8 +102,10 @@ enum PasteService {
 
     @discardableResult
     static func ensureAccessibility(prompt: Bool) -> Bool {
-        let key = kAXTrustedCheckOptionPrompt.takeUnretainedValue() as String
-        let opts = [key: prompt] as CFDictionary
+        // The SDK imports kAXTrustedCheckOptionPrompt as shared mutable state,
+        // which is unsafe under complete concurrency checking. Its documented
+        // dictionary-key value is stable, so avoid touching that global.
+        let opts = ["AXTrustedCheckOptionPrompt": prompt] as CFDictionary
         return AXIsProcessTrustedWithOptions(opts)
     }
     #endif