diff --git a/installer/scripts/darwin_postinstall.sh b/installer/scripts/darwin_postinstall.sh
index 9e22e5b..5bcb696 100644
--- a/installer/scripts/darwin_postinstall.sh
+++ b/installer/scripts/darwin_postinstall.sh
@@ -79,17 +79,6 @@ cat > "${PLIST_PATH}" << EOF
         <string>/usr/local/bin/safe-chain</string>
         <string>run</string>
     </array>
-    <key>EnvironmentVariables</key>
-    <dict>
-        <key>HTTPS_PROXY</key>
-        <string>http://localhost:8080</string>
-        <key>GLOBAL_AGENT_HTTP_PROXY</key>
-        <string>http://localhost:8080</string>
-        <key>NODE_EXTRA_CA_CERTS</key>
-        <string>${CERT_DIR}/ca-cert.pem</string>
-        <key>SAFE_CHAIN_CERT_DIR</key>
-        <string>${CERT_DIR}</string>
-    </dict>
     <key>RunAtLoad</key>
     <true/>
     <key>KeepAlive</key>
@@ -105,6 +94,12 @@ EOF
 # Set correct ownership for plist
 chown "${ACTUAL_USER}:staff" "${PLIST_PATH}"
 
+# Validate plist syntax
+if ! plutil -lint "${PLIST_PATH}" > /dev/null 2>&1; then
+  echo "⚠ Warning: Generated plist has invalid syntax"
+  exit 1
+fi
+
 # Load the LaunchAgent to start the service now
 # Need to run as the actual user, not root
 sudo -u "${ACTUAL_USER}" launchctl load "${PLIST_PATH}" 2>/dev/null || true
@@ -118,6 +113,7 @@ echo "Setting system-wide proxy environment variables..."
 sudo -u "${ACTUAL_USER}" launchctl setenv HTTPS_PROXY "http://localhost:8080"
 sudo -u "${ACTUAL_USER}" launchctl setenv GLOBAL_AGENT_HTTP_PROXY "http://localhost:8080"
 sudo -u "${ACTUAL_USER}" launchctl setenv NODE_EXTRA_CA_CERTS "${CERT_DIR}/ca-cert.pem"
+sudo -u "${ACTUAL_USER}" launchctl setenv SAFE_CHAIN_CERT_DIR "${CERT_DIR}"
 
 echo "✓ Safe Chain installed successfully!"
 echo ""
diff --git a/installer/scripts/darwin_uninstall.sh b/installer/scripts/darwin_uninstall.sh
index 484d449..1fbdb25 100644
--- a/installer/scripts/darwin_uninstall.sh
+++ b/installer/scripts/darwin_uninstall.sh
@@ -36,6 +36,7 @@ echo "Removing proxy environment variables..."
 sudo -u "${ACTUAL_USER}" launchctl unsetenv HTTPS_PROXY 2>/dev/null || true
 sudo -u "${ACTUAL_USER}" launchctl unsetenv GLOBAL_AGENT_HTTP_PROXY 2>/dev/null || true
 sudo -u "${ACTUAL_USER}" launchctl unsetenv NODE_EXTRA_CA_CERTS 2>/dev/null || true
+sudo -u "${ACTUAL_USER}" launchctl unsetenv SAFE_CHAIN_CERT_DIR 2>/dev/null || true
 
 # Remove binary
 rm -f /usr/local/bin/safe-chain