diff --git a/meson.build b/meson.build
index d7091db..43b5a98 100644
--- a/meson.build
+++ b/meson.build
@@ -30,29 +30,37 @@ resources = gnome.compile_resources(
 # client is not compiled in at all.
 cargo_features = get_option('update_check') ? '' : '--no-default-features'
 
+# The ahfail command is the Linux locker (Wayland/X11 + its own PAM service).
+# macOS keeps the PAM hook and is built without it until it has been tested there.
+is_linux = host_machine.system() == 'linux'
+cargo_pkgs = '-p ahfail-gtklock -p ahfail-pam -p ahfail-display' + (is_linux ? ' -p ahfail' : '')
+cargo_outputs = ['libahfail_module.a', 'libahfail_pam.so', 'ahfail-display'] + (is_linux ? ['ahfail'] : [])
+cargo_install_dirs = [false, get_option('libdir') / 'ahfail', get_option('libdir') / 'ahfail'] + (is_linux ? [get_option('bindir')] : [])
+cargo_copy = (' && cp "@OUTDIR@/target/release/libahfail_module.a" "@OUTPUT0@"'
+  + ' && cp "@OUTDIR@/target/release/libahfail_pam.so" "@OUTPUT1@"'
+  + ' && cp "@OUTDIR@/target/release/ahfail-display" "@OUTPUT2@"'
+  + (is_linux ? ' && cp "@OUTDIR@/target/release/ahfail" "@OUTPUT3@"' : ''))
+
 cargo_all = custom_target(
   'ahfail-cargo-build',
   input: ['Cargo.toml', 'Cargo.lock'],
-  output: ['libahfail_module.a', 'libahfail_pam.so', 'ahfail-display', 'ahfail'],
+  output: cargo_outputs,
   command: [
     'sh', '-c',
     # The PAM module's build.rs needs the absolute libdir to know where
     # ahfail-display is installed; get_option('libdir') alone is relative.
     'AHFAIL_LIBDIR=' + get_option('prefix') / get_option('libdir')
     + ' cargo build --release --locked'
-    + ' -p ahfail-gtklock -p ahfail-pam -p ahfail-display -p ahfail ' + cargo_features
+    + ' ' + cargo_pkgs + ' ' + cargo_features
     + ' --target-dir "@OUTDIR@/target"'
-    + ' && cp "@OUTDIR@/target/release/libahfail_module.a" "@OUTPUT0@"'
-    + ' && cp "@OUTDIR@/target/release/libahfail_pam.so" "@OUTPUT1@"'
-    + ' && cp "@OUTDIR@/target/release/ahfail-display" "@OUTPUT2@"'
-    + ' && cp "@OUTDIR@/target/release/ahfail" "@OUTPUT3@"'
+    + cargo_copy
   ],
   build_by_default: true,
   build_always_stale: true,  # cargo decides what is out of date, not meson
   install: true,
   # module archive: linked below, not installed; PAM module + display binary:
   # libdir/ahfail; the ahfail command: bindir.
-  install_dir: [false, get_option('libdir') / 'ahfail', get_option('libdir') / 'ahfail', get_option('bindir')],
+  install_dir: cargo_install_dirs,
   install_mode: 'rwxr-xr-x'
 )
 cargo_target = cargo_all[0]
@@ -60,10 +68,12 @@ pam_cargo = cargo_all[1]
 
 # The locker's own PAM service. Shipped as its own file, like swaylock and
 # gtklock do, so no other package's PAM configuration is ever touched.
-install_data('data/pam.d/ahfail',
-  install_dir: get_option('sysconfdir') / 'pam.d',
-  install_mode: 'rw-r--r--'
-)
+if is_linux
+  install_data('data/pam.d/ahfail',
+    install_dir: get_option('sysconfdir') / 'pam.d',
+    install_mode: 'rw-r--r--'
+  )
+endif
 
 libahfail = shared_library(
   'ahfail-module',
diff --git a/packaging/aur/PKGBUILD b/packaging/aur/PKGBUILD
index 5673411..bc651de 100644
--- a/packaging/aur/PKGBUILD
+++ b/packaging/aur/PKGBUILD
@@ -1,4 +1,23 @@
 # Maintainer: Asger Geel Weirsoe <asger@weircon.dk>
+#
+# DISCLAIMER
+#
+# ahfail is a joke with a real screen locker underneath. Two things to know
+# before installing it:
+#
+# 1. Security. It sits in the authentication path of your session. It is
+#    provided as is, without any warranty (see the AGPL-3.0 license). On
+#    Wayland a crash leaves the session locked; on X11, as with i3lock, a
+#    killed locker leaves it open. /etc/pam.d/ahfail includes `login`, so
+#    the system's pam_faillock policy applies to wrong guesses.
+#
+# 2. Media. The sprite frames and the audio clip are a parody of the
+#    "ah ah ah, you didn't say the magic word" scene from Jurassic Park
+#    (1993). The film and its characters belong to their respective rights
+#    holders; they are used here non-commercially for parody, and the
+#    AGPL-3.0 license covers the code, not those assets. Rights holders who
+#    object can reach the maintainer at the address above and the assets
+#    will be replaced.
 pkgname=ahfail
 pkgver=0.0.0
 pkgrel=1
diff --git a/readme.md b/readme.md
index e2725e6..92e020f 100644
--- a/readme.md
+++ b/readme.md
@@ -8,7 +8,7 @@ ahfail test     # show the effect once, without locking anything
 ahfail doctor   # check this machine and explain what is missing
 ```
 
-One command on every platform: `ahfail` works out whether you run Wayland or X11 (or macOS) and does the right thing.
+One command on Linux: `ahfail` works out whether you run Wayland or X11 and does the right thing. On macOS the effect comes from a PAM hook on the system lock screen (see below).
 
 ---
 
@@ -51,7 +51,7 @@ Then run `ahfail doctor`. It tells you whether the session type is supported, wh
 |---|---|---|
 | Linux, **Wayland** | ext-session-lock-v1 (through gtk-session-lock) | sway, Hyprland, niri, river, labwc and KDE Plasma 6. **Not GNOME**: GNOME does not let third-party programs lock the screen. |
 | Linux, **X11** | full-screen windows on every monitor plus a keyboard and pointer grab | The i3lock model. Works with any X11 window manager. |
-| **macOS** | the system lock screen | `ahfail` asks macOS to lock; the effect comes from the PAM hook installed via Homebrew (see below). |
+| **macOS** | the system lock screen | Lock the Mac as usual; the effect comes from the PAM hook installed via Homebrew (see below). The `ahfail` command itself is Linux only for now. |
 
 ## Locking automatically
 
@@ -85,7 +85,7 @@ brew tap agw/ahfail https://gitea.weircon.dk/agw/homebrew-ahfail
 brew install ahfail
 ```
 
-After install, Homebrew prints the PAM line to add to `/etc/pam.d/screensaverui` (macOS 13+) or `/etc/pam.d/screensaver` (macOS 12 and earlier). That one-line edit is the only manual step. Enable "Require password immediately" in System Settings so `ahfail` actually locks.
+After install, Homebrew prints the PAM line to add to `/etc/pam.d/screensaverui` (macOS 13+) or `/etc/pam.d/screensaver` (macOS 12 and earlier). That one-line edit is the only manual step. Enable "Require password immediately" in System Settings so the lock screen asks for the password straight away.
 
 To upgrade: `brew upgrade ahfail`. To uninstall: `sudo sed -i '' '/ahfail/d' /etc/pam.d/screensaverui` (or `screensaver`), then `brew uninstall ahfail`.