diff --git a/packaging/release-notes.md b/packaging/release-notes.md
index 63faa82..cf19ff4 100644
--- a/packaging/release-notes.md
+++ b/packaging/release-notes.md
@@ -76,7 +76,8 @@ adapter is present; `--software-renderer` (or its equivalent `--renderer=cpu`) f
 ## Verify the download
 
 ```bash
-sha256sum -c SHA256SUMS.txt --ignore-missing   # Linux / macOS
+sha256sum -c SHA256SUMS.txt --ignore-missing   # Linux
+shasum -a 256 -c SHA256SUMS.txt                # macOS (sha256sum is not bundled)
 Get-FileHash .\unlucky-launcher_{{VERSION}}_windows_x64.exe -Algorithm SHA256   # Windows PowerShell
 ```
 
@@ -87,9 +88,10 @@ Get-FileHash .\unlucky-launcher_{{VERSION}}_windows_x64.exe -Algorithm SHA256
 ## Known limitations of this build
 
 - Microsoft (MSA) sign-in needs an Azure public client id, and release binaries do not carry one: set
-  `ULL_MSA_CLIENT_ID=<id>` before launching, or build with that variable set. Until then the app says
-  "not configured" (with the command to fix it) instead of failing silently. Offline profiles and
-  authlib-injector servers need no id.
+  `ULL_MSA_CLIENT_ID=<id>` before launching, or build with that variable set. Without it sign-in stops
+  before any network call; in the GUI that shows up as the generic "Sign-in failed" banner with
+  `Code: other` (the full reason goes to the launcher log), and `ull accounts add msa` prints the exact
+  fix. Offline profiles and authlib-injector servers need no id.
 - Binaries are not code-signed / notarized yet: Windows SmartScreen and macOS Gatekeeper warn on first
   launch. The checksums above are the integrity reference for now.
 - macOS ships the bare binary (single-file promise), not a `.app` bundle: no Dock icon or Finder