diff --git a/scripts/codesign-mac-app.sh b/scripts/codesign-mac-app.sh
index d8b96cffd4f..7b9f17bc35a 100755
--- a/scripts/codesign-mac-app.sh
+++ b/scripts/codesign-mac-app.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-APP_BUNDLE="${1:-dist/OpenClaw.app}"
+APP_BUNDLE="dist/OpenClaw.app"
 IDENTITY="${SIGN_IDENTITY:-}"
 TIMESTAMP_MODE="${CODESIGN_TIMESTAMP:-auto}"
 DISABLE_LIBRARY_VALIDATION="${DISABLE_LIBRARY_VALIDATION:-0}"
@@ -14,7 +14,7 @@ cleanup() {
   fi
 }
 
-if [[ "${APP_BUNDLE}" == "--help" || "${APP_BUNDLE}" == "-h" ]]; then
+if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
   cat <<'HELP'
 Usage: scripts/codesign-mac-app.sh [app-bundle]
 
@@ -28,6 +28,20 @@ HELP
   exit 0
 fi
 
+if [[ "${1:-}" == "--" ]]; then
+  shift
+fi
+if [[ "$#" -gt 0 ]]; then
+  case "$1" in
+    -*) echo "ERROR: Unknown codesign option: $1" >&2; exit 1 ;;
+    *) APP_BUNDLE="$1"; shift ;;
+  esac
+fi
+if [[ "$#" -gt 0 ]]; then
+  echo "ERROR: Unexpected codesign argument: $1" >&2
+  exit 1
+fi
+
 if [ ! -d "$APP_BUNDLE" ]; then
   echo "App bundle not found: $APP_BUNDLE" >&2
   exit 1
diff --git a/test/scripts/codesign-mac-app.test.ts b/test/scripts/codesign-mac-app.test.ts
index 76e47d4d6c4..51c91d97401 100644
--- a/test/scripts/codesign-mac-app.test.ts
+++ b/test/scripts/codesign-mac-app.test.ts
@@ -118,6 +118,26 @@ describe("codesign-mac-app temp file hygiene", () => {
     expect(entitlementTemps(tempRoot)).toEqual([]);
   });
 
+  it("rejects unknown options before app validation", () => {
+    const tempRoot = makeTempDir("openclaw-codesign-unknown-");
+    const result = runCodesign(["--wat"], tempRoot);
+
+    expect(result.status).toBe(1);
+    expect(result.stderr.trim()).toBe("ERROR: Unknown codesign option: --wat");
+    expect(entitlementTemps(tempRoot)).toEqual([]);
+  });
+
+  it("rejects extra app bundle arguments before signing", () => {
+    const tempRoot = makeTempDir("openclaw-codesign-extra-");
+    const app = path.join(tempRoot, "Fake.app");
+    mkdirSync(path.join(app, "Contents", "MacOS"), { recursive: true });
+    const result = runCodesign([app, "extra"], tempRoot);
+
+    expect(result.status).toBe(1);
+    expect(result.stderr.trim()).toBe("ERROR: Unexpected codesign argument: extra");
+    expect(entitlementTemps(tempRoot)).toEqual([]);
+  });
+
   it("cleans entitlement temp files when signing fails", () => {
     const tempRoot = makeTempDir("openclaw-codesign-fail-");
     const app = path.join(tempRoot, "Fake.app");