diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5b00cd5..6e7f4c9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,8 +38,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Check out BoxLite
-        run: git clone --recurse-submodules --depth 1 https://github.com/boxlite-ai/boxlite.git ../boxlite
+      - name: Check out BoxLite (pinned to Cargo.lock revision)
+        run: |
+          BOXLITE_REV=$(grep -A2 'name = "boxlite"' Cargo.lock | sed -n 's/.*#\([0-9a-f]*\)".*/\1/p')
+          git clone --recurse-submodules https://github.com/boxlite-ai/boxlite.git ../boxlite
+          cd ../boxlite && git checkout "$BOXLITE_REV"
 
       - uses: dtolnay/rust-toolchain@stable
         with:
diff --git a/scripts/install-local.sh b/scripts/install-local.sh
index 5132a80..7581b82 100755
--- a/scripts/install-local.sh
+++ b/scripts/install-local.sh
@@ -13,13 +13,19 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 BOXLITE_ROOT="$PROJECT_ROOT/../boxlite"
 
-# 0) Auto-clone BoxLite if not present
+# 0) Auto-clone BoxLite if not present, pinned to Cargo.lock revision
+BOXLITE_REV=$(grep -A2 'name = "boxlite"' "$PROJECT_ROOT/Cargo.lock" | sed -n 's/.*#\([0-9a-f]*\)".*/\1/p')
 if [ ! -d "$BOXLITE_ROOT" ]; then
   echo "==> BoxLite not found at $BOXLITE_ROOT, cloning..."
-  git clone --recurse-submodules --depth 1 \
+  git clone --recurse-submodules \
     https://github.com/boxlite-ai/boxlite.git "$BOXLITE_ROOT"
 fi
 BOXLITE_ROOT="$(cd "$BOXLITE_ROOT" && pwd)"
+if [ -n "$BOXLITE_REV" ]; then
+  echo "==> Pinning BoxLite to Cargo.lock revision: $BOXLITE_REV"
+  cd "$BOXLITE_ROOT" && git checkout "$BOXLITE_REV"
+  cd "$PROJECT_ROOT"
+fi
 
 # 1) Build boxrun binary
 echo "==> Building boxrun (release)..."
@@ -40,6 +46,11 @@ mkdir -p "${BOXRUN_HOME}/runtime"
 cp "$PROJECT_ROOT/target/release/boxrun" "${BOXRUN_HOME}/boxrun"
 chmod +x "${BOXRUN_HOME}/boxrun"
 
+# Add rpath so the binary can find runtime dylibs (libkrun, libgvproxy, etc.)
+if [ "$(uname)" = "Darwin" ]; then
+  install_name_tool -add_rpath @executable_path/runtime "${BOXRUN_HOME}/boxrun" 2>/dev/null || true
+fi
+
 cp -f "$RUNTIME_DIR"/* "${BOXRUN_HOME}/runtime/" 2>/dev/null || true
 chmod +x "${BOXRUN_HOME}/runtime/boxlite-guest" "${BOXRUN_HOME}/runtime/boxlite-shim" 2>/dev/null || true