macOS updates arrive regularly — security patches, feature updates, a major release every year. On a CI/CD build Mac, you don’t want to install every update immediately, because tools (above all Xcode) are version-specific. Here’s how we approach it.
Update types
macOS has three update categories:
Security updates
- Close critical security holes
- No feature changes
- Rarely break anything
- Should be installed
Minor patches (e.g. macOS 15.3 → 15.4)
- Bug fixes, smaller features
- Sometimes driver changes
- Usually safe to install
Major upgrades (e.g. macOS 15 → 16)
- A completely new version with new APIs
- Xcode compatibility not guaranteed
- macOS build tools sometimes break
- Decide deliberately when to switch
What we do on the server side
We do NOT directly manage macOS updates on your Mac.
Why? macOS belongs to you, with your Apple ID, your installed tools, your CI config. We don’t want to push updates that break your pipeline.
What we do:
- Hardware maintenance (RAM, disk health checks, power supply)
- macOS major upgrade advice on request (which version is stable with which Xcode version, what’s changing)
- Recovery help after a broken update
What you should check regularly
Weekly: security updates
In macOS: System Settings → General → Software Update.
If a security update is available: install it promptly (within 1–7 days).
Optionally, turn on automatic installation:
- Automatic updates → Install security updates: yes
macOS then applies security patches on its own.
Monthly: minor patches
For a minor update (e.g. macOS 15.3 → 15.4):
- Back up first (Time Machine runs anyway, but feel free to trigger one manually)
- Read the release notes (apple.com/macos/whats-new or the Apple developer notes)
- With critical tools: test on a clone (see below)
- Install the update: via AnyDesk, since Apple sometimes shows a login prompt during the update
Yearly: the major upgrade decision
When a new macOS version comes out:
- Wait at least 2–3 months — early macOS versions often have bugs
- Check Xcode compatibility: which Xcode versions does the new macOS support?
- CI pipeline tests: clone the Mac to the new version, test the CI pipeline there
- For critical setups: a second Mac as a test bed
- Decide: update now, or keep waiting
The update procedure
Before the update
- Check backup status: Time Machine + Synology backup (if any) running?
- Finish current builds: no CI jobs active
- Pause CI runners: stop GitHub Actions / GitLab runners
- Clean up the system: delete old caches, at least 30 GB of free disk space
During the update
We recommend being present via AnyDesk:
- Apple sometimes shows license confirmations
- For major updates: the Apple ID password is requested
- With an encrypted volume: the FileVault password
- The update can take 30–90 minutes
The Mac reboots once or twice. During the reboot, AnyDesk is gone — wait.
After the update
- Log in: the Mac should come back with all your data
- Tools test: open Xcode, test briefly
- CI test: manually start a small test build
- Reactivate CI runners: start GitHub Actions / GitLab runners
Xcode compatibility
Apple’s typical rule:
- The current Xcode version runs on the current AND previous macOS version
- After a macOS major upgrade: the old Xcode version often keeps working for a while, but not with newer iOS/iPadOS SDKs
Example:
- macOS 15: Xcode 15.x and Xcode 16.x
- macOS 16: Xcode 16.x and Xcode 17.x (and old Xcode 15 runs in theory, but isn’t supported)
Strategy: do the macOS update after the Xcode update, not before.
App Store apps and updates
Xcode comes from the App Store. Other tools too (Pages, Numbers, Final Cut Pro, etc.) update via the Mac App Store.
Do not run App Store updates automatically on CI/CD Macs — some tools have mandatory migration steps on first launch after an update.
In System Settings → App Store → automatic updates: off.
Manual updates via App Store → Updates.
Test strategy for critical updates
If an update is critical for your CI pipeline:
Option 1: a test Mac
On request, we can provide a second short-term test Mac (a trial plan for 1–2 weeks). Install the update there, run the CI pipeline through, then update the production Mac.
Open a ticket if you need this.
Option 2: a cloned disk
With Carbon Copy Cloner or SuperDuper:
- Clone the Mac system to a separate volume (its own SSD, the 1 TB SSD add-on works well for this) — fully remote
- Boot from the clone volume: we take care of this step. The boot picker needs physical access to the device, and AnyDesk isn’t running yet at boot. Open a ticket, and we’ll start the Mac from the clone.
- Install and test the update on the clone
- If OK: a ticket for booting back to the original volume, then install the update there
Option 1 (test Mac) involves less back and forth.
Option 3: just do it, but back up first
For smaller updates: trust that Apple’s QA is good enough. A Time Machine backup before the update makes a restore possible if it breaks.
When an update breaks things
Symptom: the Mac no longer boots properly, tools are broken, etc.
Step 1: Time Machine restore
On the Mac via AnyDesk:
- Applications → Utilities → Migration Assistant
- Restore from Time Machine
- Pick the state from before the update
- Restore apps + system
Duration: 30–60 minutes.
Step 2: factory-reset the Mac
If a Time Machine restore isn’t enough:
- Boot macOS Recovery Mode (difficult via AnyDesk — better with our help)
- Reinstall the Mac completely
- Restore from Time Machine
For this case: open a ticket. We’ll help.
Step 3: hardware replacement (worst case)
If truly nothing works anymore: we replace the Mac hardware. Set up fresh from the Time Machine backup.
Hence: a backup is mandatory.
macOS beta programs
Apple offers public beta and developer beta programs.
On production Macs: do NOT enroll in beta programs. Beta versions are unstable and frequently break tools.
On separate test Macs: betas are interesting for preparing for future macOS versions.
Frequently asked questions
How often do security updates arrive? Apple typically publishes security patches monthly (often on the same day as iOS updates).
Installing a major update — when is it “safe”? Rule of thumb: 2–3 months after release. The initial 0.0 version usually has bugs; after the 0.1 and 0.2 patches, it’s stable.
Can macOS updates go backwards (downgrade)? Only in a limited way. A major downgrade only via full reinstall + Time Machine restore. A minor downgrade usually not at all.
What if a macOS update breaks Xcode?
Reinstall Xcode from the App Store. For version problems: a multi-Xcode setup, switching versions with xcode-select.
FileVault — should I enable it? For a Mac mini in our rack: less critical. If compliance requires it: yes.
Auto-updates for security patches — safe? Yes, recommended. Apple’s QA is good for security patches; they rarely break anything.
What if an update deletes user files? It shouldn’t happen, but it’s theoretically possible. A Time Machine backup saves you.
A macOS update over AnyDesk — no problems with mouse clicks during the reboot? Reboots run on their own; the AnyDesk connection drops for 1–2 minutes and comes back automatically.
What’s next
First login with AnyDesk
What you get after ordering your Mac mini and how the first AnyDesk session works. A default setup that works right away.
Configuring AnyDesk in depth
Set up AnyDesk on the Mac so it works securely and reliably as a permanent connection. Unattended access, 2FA, security settings.
Enabling and using Apple Screen Sharing (VNC)
macOS' built-in remote desktop. When AnyDesk isn't the right fit: enable Screen Sharing, connect from Mac/iPad/Windows, performance tuning.
SSH and headless workflows
Controlling your Mac via SSH: public-key auth, tmux sessions, Xcode builds from the command line, GitHub Actions runners. When you don't need a desktop.