diff --git a/.github/workflows/dry-run.yml b/.github/workflows/dry-run.yml
index 4dc538804..938ff8d50 100644
--- a/.github/workflows/dry-run.yml
+++ b/.github/workflows/dry-run.yml
@@ -324,7 +324,7 @@ jobs:
             sed -i '' 's/^Example/#Example/' "$CLAMAV_ETC/freshclam.conf" 2>/dev/null || true
             echo "DatabaseMirror database.clamav.net" >> "$CLAMAV_ETC/freshclam.conf"
           fi
-          freshclam --quiet
+          freshclam --quiet --no-warnings 2>/dev/null || freshclam --quiet 2>/dev/null || echo "WARNING: freshclam update failed, using bundled signatures"
           echo "=== ClamAV scan (macOS) ==="
           clamscan --no-summary ./codebase-memory-mcp
           echo "=== ClamAV: clean ==="
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c835318ef..dd9dd7712 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -315,14 +315,14 @@ jobs:
         if: matrix.variant == 'standard' && startsWith(matrix.os, 'macos')
         run: |
           brew install clamav > /dev/null 2>&1
-          # Create freshclam config if missing
           CLAMAV_ETC=$(brew --prefix)/etc/clamav
           if [ ! -f "$CLAMAV_ETC/freshclam.conf" ]; then
             cp "$CLAMAV_ETC/freshclam.conf.sample" "$CLAMAV_ETC/freshclam.conf" 2>/dev/null || true
             sed -i '' 's/^Example/#Example/' "$CLAMAV_ETC/freshclam.conf" 2>/dev/null || true
             echo "DatabaseMirror database.clamav.net" >> "$CLAMAV_ETC/freshclam.conf"
           fi
-          freshclam --quiet
+          # Download signatures (--no-warnings suppresses X509 store errors on macOS)
+          freshclam --quiet --no-warnings 2>/dev/null || freshclam --quiet 2>/dev/null || echo "WARNING: freshclam update failed, using bundled signatures"
           echo "=== ClamAV scan (macOS) ==="
           clamscan --no-summary ./codebase-memory-mcp
           echo "=== ClamAV: clean ==="