diff --git a/.github/actions/test-and-upload-image/action.yaml b/.github/actions/test-and-upload-image/action.yaml
index 8c0cb01a5..80f45e130 100644
--- a/.github/actions/test-and-upload-image/action.yaml
+++ b/.github/actions/test-and-upload-image/action.yaml
@@ -46,7 +46,8 @@ runs:
       - name: Test image
         if: ${{ inputs.multi-arch == 'false' && inputs.testing }}
         run: |
-          nix run --fallback .#local-image-test ${{ inputs.image }}
+          # --impure is so we can pull in DOCKER_HOST for macs
+          nix run --fallback .#local-image-test ${{ inputs.image }} --impure
         shell: bash -euo pipefail {0}
 
       - name: Upload image
diff --git a/.github/workflows/image-mac.yaml b/.github/workflows/image-mac.yaml
new file mode 100644
index 000000000..7fe11fd99
--- /dev/null
+++ b/.github/workflows/image-mac.yaml
@@ -0,0 +1,82 @@
+---
+name: Create nativelink-worker-lre-rs image for Mac
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    paths-ignore:
+      - '.github/styles/**'
+      - 'web/**'
+
+permissions: read-all
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  publish-image:
+    name: Publish nativelink-worker-lre-rs for Mac
+    runs-on: macos-26
+    permissions:
+      id-token: write
+      security-events: write
+    timeout-minutes: 90
+    steps:
+      - name: Checkout
+        uses: >- # v6.0.2
+          actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
+      - name: Prepare Worker
+        uses: ./.github/actions/prepare-nix
+        with:
+          nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
+
+      - name: Set up Docker
+        id: docker
+        uses: >- # v5.2.0
+          docker/setup-docker-action@0234bb73ccb40f0c430b795634f9247e2b5c2d23
+        env:
+          # m1 chips, as seen in the GitHub CI, don't support nested hardware virtualization.
+          #
+          # We need `-machine virt` to stop Lima from providing `accel=hvf`due to this
+          # [QEMU issue](https://gitlab.com/qemu-project/qemu/-/issues/2981).
+          #
+          # We also need `-cpu *` to stop Lima from providing `-cpu host` as:
+          # 1) `-cpu host` requires `kvm` or `hvf` (which we don't have)
+          # 2) `-cpu host` implies `host-phys-bits=on` which is borked in this environment
+          # From which CPU to actually emulate, we choose what will be the most performant.
+          #
+          # We accomplish both of these goals with the methodology from
+          # [this comment](https://github.com/lima-vm/lima/pull/3173#issuecomment-2623130310).
+          QEMU_SYSTEM_AARCH64: "qemu-system-aarch64 -machine virt -cpu max,pmu=off,sve=on,sve128=on,sme=off,pauth=off"
+
+      - name: Set docker host
+        run: |
+          echo "DOCKER_HOST=${{steps.docker.outputs.sock}}" >> "$GITHUB_ENV"
+
+      - id: version
+        uses: ./.github/actions/generate-version
+
+      - name: Test and upload nativelink-worker-lre-rs
+        uses: ./.github/actions/test-and-upload-image
+        with:
+          image: nativelink-worker-lre-rs
+          multi-arch: false
+          tag: ${{ steps.version.outputs.version-string }}
+          GHCR_USERNAME: ${{ vars.GHCR_PUBLISH_USER }}
+          GHCR_PASSWORD: ${{ secrets.GHCR_PUBLISH_TOKEN }}
+
+      - name: Upload trivy scan results to GitHub Security tab
+        uses: >- # v4.36.2
+          github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e
+        with:
+          sarif_file: 'trivy-results.sarif'
+        if: ${{ contains(fromJson('["refs/heads/main", "refs/pull/2457/merge"]'), github.ref) }}
+
+      - name: Teardown Worker
+        uses: ./.github/actions/end-nix
+        if: always()
+        with:
+          nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}
diff --git a/tools/public/local-image-test.nix b/tools/public/local-image-test.nix
index 428c52e73..5798ad912 100644
--- a/tools/public/local-image-test.nix
+++ b/tools/public/local-image-test.nix
@@ -28,7 +28,11 @@ writeShellScriptBin "local-image-test" ''
     # so we can run --debug on skopeo
     # nix run .#$1.copyTo docker-daemon:''${IMAGE_TARGET}
     nix build .#$1
-    ${skopeo}/bin/skopeo --debug --insecure-policy copy nix:''${IMAGE} docker-daemon:''${IMAGE_TARGET}
+    EXTRA_ARGS=
+    if [[ -n ''${DOCKER_HOST:-} ]]; then
+      EXTRA_ARGS="--dest-daemon-host=''${DOCKER_HOST}"
+    fi
+    ${skopeo}/bin/skopeo --debug --insecure-policy copy ''${EXTRA_ARGS} nix:''${IMAGE} docker-daemon:''${IMAGE_TARGET}
   fi
 
   # Ensure that the image has minimal closure size.
@@ -41,5 +45,6 @@ writeShellScriptBin "local-image-test" ''
   #                    https://github.com/aquasecurity/trivy-action/issues/389
   ${trivy}/bin/trivy image \
     ''${IMAGE_TARGET} \
+    --timeout 15m \
     --db-repository public.ecr.aws/aquasecurity/trivy-db:2
 ''
diff --git a/tools/public/trivy-report.nix b/tools/public/trivy-report.nix
index 9b76d066d..378a86377 100644
--- a/tools/public/trivy-report.nix
+++ b/tools/public/trivy-report.nix
@@ -10,6 +10,7 @@ writeShellScriptBin "trivy-report" ''
     ${trivy}/bin/trivy \
       image \
       --format sarif \
+      --timeout 15m \
       $1 \
     > trivy-results.sarif
   else
diff --git a/typos.toml b/typos.toml
index 356f7e4ba..fab7c522e 100644
--- a/typos.toml
+++ b/typos.toml
@@ -3,10 +3,12 @@
 conly = "conly"
 
 [default]
-# Old wrong spelling support
 extend-ignore-re = [
+  # Old wrong spelling support
   "alias = \"Cachable\"",
   "old_unique_qualifier_cachable_works",
+  # Argument in .github/workflows/image.yaml
+  "sme=off",
 ]
 
 [files]