diff --git a/README.md b/README.md
index f72619d..4a09fa3 100644
--- a/README.md
+++ b/README.md
@@ -22,9 +22,11 @@ Module name: `dixwaveform` · target: **VLC 3.0.x**, macOS **arm64** (portable t
 ```sh
 ./install.sh
 ```
-One-shot permanent install so **every** VLC launch finds the plugin — including Dock / Finder / Spotlight / Start-menu launches, which do *not* inherit your shell environment. On **macOS** the installer copies the plugin straight into `VLC.app`'s own plugin bundle and invalidates VLC's plugin cache (the reliable fix — an env var alone won't survive a GUI launch), and also wires `VLC_PLUGIN_PATH` (shell rc + LaunchAgent) as a fallback for terminal launches. Idempotent; safe to re-run. (To just build without touching your environment, use `./build.sh` below.)
+One-shot permanent install so **every** VLC launch finds the plugin — including Dock / Finder / Spotlight / Start-menu launches, which do *not* inherit your shell environment. On **macOS** the installer copies the plugin straight into `VLC.app`'s own plugin bundle, invalidates VLC's plugin cache, and **re-seals the app's code signature** (ad-hoc, preserving VLC's entitlements) — that last step is required because adding a file to the signed bundle otherwise makes macOS refuse to launch it. It also wires `VLC_PLUGIN_PATH` (shell rc + LaunchAgent) as a fallback for terminal launches. Idempotent; safe to re-run. (To just build without touching your environment, use `./build.sh` below.)
 
-> **Not seeing "Dix Analyzer" under Audio ▸ Visualizations after a Dock/Start-menu launch?** That's the env-var gap — re-run `./install.sh` (macOS installs into the app bundle), then **fully quit and relaunch** VLC. If VLC is installed somewhere other than `/Applications/VLC.app`, run `VLC_APP=/path/to/VLC.app ./install.sh`.
+> **Not seeing "Dix Analyzer" under Audio ▸ Visualizations after a Dock/Start-menu launch?** Re-run `./install.sh` (macOS installs into the app bundle), then **fully quit and relaunch** VLC. If VLC is installed somewhere other than `/Applications/VLC.app`, run `VLC_APP=/path/to/VLC.app ./install.sh`.
+>
+> **VLC won't open at all after installing?** The bundle edit broke VLC's signature seal. `./install.sh` now re-seals it automatically; if you hit this on an older install, run: `xattr -cr /Applications/VLC.app && codesign -f -s - --preserve-metadata=entitlements /Applications/VLC.app`. (VLC.app becomes ad-hoc signed; a fresh VLC reinstall restores the original signature — just re-run `./install.sh` after.)
 
 ## Build (macOS, arm64)
 ```sh
diff --git a/install.sh b/install.sh
index 4b29667..f5f55f0 100755
--- a/install.sh
+++ b/install.sh
@@ -60,7 +60,19 @@ if [ "$OS" = "Darwin" ]; then
     $SUDO rm -f "$BUNDLE_PLUGINS/plugins.dat"
     CACHE_GEN="$VLC_APP/Contents/MacOS/lib/vlc-cache-gen"
     [ -x "$CACHE_GEN" ] && $SUDO "$CACHE_GEN" "$BUNDLE_PLUGINS" 2>/dev/null || true
-    echo "   installed: $BUNDLE_PLUGINS/$PLUGIN_DYLIB"
+
+    # CRITICAL: adding a file to VLC.app invalidates its code-signature seal, and
+    # macOS then REFUSES to launch it from the Dock/Finder ("a sealed resource is
+    # missing or invalid" — a launch refusal, so there's no crash log). Re-seal the
+    # bundle ad-hoc (preserving VLC's entitlements so plugins still load) and clear
+    # quarantine so Gatekeeper allows the locally-modified app to open.
+    echo "   re-sealing VLC.app signature (required after modifying the bundle)..."
+    $SUDO xattr -cr "$VLC_APP" 2>/dev/null || true
+    $SUDO codesign -f -s - --preserve-metadata=entitlements "$VLC_APP" 2>/dev/null \
+      || $SUDO codesign -f -s - "$VLC_APP" 2>/dev/null || true
+    echo "   installed + re-sealed: $BUNDLE_PLUGINS/$PLUGIN_DYLIB"
+    echo "   (VLC.app is now ad-hoc signed; a future VLC reinstall restores the"
+    echo "    original signature — just re-run ./install.sh afterward.)"
   else
     echo "   WARNING: $VLC_APP not found — skipping bundle install."
     echo "            Set VLC_APP=/path/to/VLC.app and re-run if VLC lives elsewhere."
diff --git a/waveform.c b/waveform.c
index c2d2be3..da1d214 100644
--- a/waveform.c
+++ b/waveform.c
@@ -29,7 +29,7 @@
 #include "dix_pitch.h"   /* pure pitch/chroma/key DSP (unit-tested standalone) */
 #include "dix_lufs.h"    /* ITU-R BS.1770 loudness (unit-tested standalone) */
 
-#define DIX_VERSION "3.5"
+#define DIX_VERSION "3.5.1"
 #define DIX_W 1280
 #define DIX_H 720
 #define DIX_MAX_FFT 8192