diff --git a/crates/dwg-thumbnailer/macos/ThumbnailProvider.swift b/crates/dwg-thumbnailer/macos/ThumbnailProvider.swift
index 62065560c..c864311f2 100644
--- a/crates/dwg-thumbnailer/macos/ThumbnailProvider.swift
+++ b/crates/dwg-thumbnailer/macos/ThumbnailProvider.swift
@@ -39,9 +39,19 @@ final class ThumbnailProvider: QLThumbnailProvider {
             return
         }
 
-        let size = CGSize(width: cg.width, height: cg.height)
-        let reply = QLThumbnailReply(contextSize: size) { (ctx: CGContext) -> Bool in
-            ctx.draw(cg, in: CGRect(origin: .zero, size: size))
+        // The embedded DWG preview bitmap is often much smaller than the
+        // requested icon size. Scale it up (or down) to fit request.maximumSize
+        // and center it — otherwise QuickLook draws it at its native pixel size
+        // anchored at the CGContext origin (bottom-left), producing a small
+        // thumbnail stuck in the corner instead of filling the icon (#365).
+        let maxSize = request.maximumSize
+        let nativeSize = CGSize(width: cg.width, height: cg.height)
+        let scale = min(maxSize.width / nativeSize.width, maxSize.height / nativeSize.height)
+        let drawSize = CGSize(width: nativeSize.width * scale, height: nativeSize.height * scale)
+        let origin = CGPoint(x: (maxSize.width - drawSize.width) / 2, y: (maxSize.height - drawSize.height) / 2)
+
+        let reply = QLThumbnailReply(contextSize: maxSize) { (ctx: CGContext) -> Bool in
+            ctx.draw(cg, in: CGRect(origin: origin, size: drawSize))
             return true
         }
         handler(reply, nil)
diff --git a/packaging/build_macos_signed.sh b/packaging/build_macos_signed.sh
index 97ef76563..aadce077c 100755
--- a/packaging/build_macos_signed.sh
+++ b/packaging/build_macos_signed.sh
@@ -93,8 +93,21 @@ sed "s/__VERSION__/$VERSION/g" packaging/Info.plist > "$APP/Contents/Info.plist"
 
 echo "==> codesign"
 if [ "$DEVELOPER_ID" = "-" ]; then
-    # CI-parity ad-hoc signature; cannot be notarized.
-    codesign --force --deep --sign - --timestamp=none "$APP"
+    # CI-parity ad-hoc signature; cannot be notarized. Still sign nested
+    # code individually, in the same order as the Developer ID path below,
+    # rather than one `--deep` pass over the outer bundle: `--deep` re-signs
+    # every nested binary with the *outer* invocation's own arguments, which
+    # here carried no --entitlements at all — so the appex ended up ad-hoc
+    # signed but missing its sandbox entitlement, and PlugInKit silently
+    # dropped it ("rejecting ... plug-ins must be sandboxed" in the system
+    # log, no error surfaced anywhere else) (#365). Ad-hoc signing itself is
+    # not the blocker here — carrying the entitlements through is.
+    codesign --force --sign - --timestamp=none \
+        "$APP/Contents/MacOS/OpenCADStudio-App"
+    codesign --force --sign - --timestamp=none \
+        --entitlements crates/dwg-thumbnailer/macos/entitlements.plist \
+        "$APP/Contents/PlugIns/DWGThumbnail.appex"
+    codesign --force --sign - --timestamp=none "$APP"
 else
     # Sign nested code before the outer bundle. The sandbox entitlement is
     # required for the QuickLook extension. Use hardened runtime