diff --git a/Dockerfile.macos-dev b/Dockerfile.macos-dev
new file mode 100644
index 0000000000..ff2909e533
--- /dev/null
+++ b/Dockerfile.macos-dev
@@ -0,0 +1,58 @@
+# Dev Dockerfile for building on Apple Silicon Macs.
+#
+# The original Dockerfile compiles Go inside the container, which requires
+# QEMU amd64 emulation on ARM Macs. QEMU crashes with segfaults during
+# `go mod download` (network syscall emulation issue). This Dockerfile skips
+# the in-container Go build and instead expects a pre-built binary at
+# bin/cluster-logging-operator, cross-compiled natively on the host.
+#
+# Usage:
+#   GOOS=linux GOARCH=amd64 make build
+#   podman build -t $(IMAGE_TAG) . -f Dockerfile.macos-dev
+
+FROM --platform=linux/amd64 quay.io/openshift/origin-cli-artifacts:latest AS origincli
+
+RUN case $(uname -m) in \
+    x86_64) cp /usr/share/openshift/linux_amd64/oc.rhel9 /tmp/oc ;; \
+    aarch64) cp /usr/share/openshift/linux_arm64/oc.rhel9 /tmp/oc ;; \
+    ppc64le) cp /usr/share/openshift/linux_ppc64le/oc.rhel9 /tmp/oc ;; \
+    s390x) cp /usr/share/openshift/linux_s390x/oc /tmp/oc ;; \
+    *) echo "Unsupported architecture"; exit 1 ;; \
+esac
+
+FROM --platform=linux/amd64 registry.access.redhat.com/ubi9/ubi-minimal
+
+ENV SRC_DIR=./
+
+RUN INSTALL_PKGS=" \
+      openssl \
+      rsync \
+      file \
+      xz \
+      " && \
+    microdnf install -y $INSTALL_PKGS && \
+    rpm -V $INSTALL_PKGS && \
+    microdnf clean all && \
+    mkdir /tmp/ocp-clo && \
+    chmod og+w /tmp/ocp-clo
+
+COPY bin/cluster-logging-operator /usr/bin/
+
+COPY --from=origincli /tmp/oc /usr/bin/oc
+
+COPY $SRC_DIR/must-gather/collection-scripts/* /usr/bin/
+
+USER 1000
+WORKDIR /usr/bin
+CMD ["/usr/bin/cluster-logging-operator"]
+
+LABEL \
+        io.k8s.display-name="Cluster Logging Operator" \
+        io.k8s.description="This is a component of OpenShift Container Platform that manages the lifecycle of the Aggregated logging stack." \
+        io.openshift.tags="openshift,logging" \
+        com.redhat.delivery.appregistry="false" \
+        maintainer="AOS Logging <team-logging@redhat.com>" \
+        License="Apache-2.0" \
+        name="openshift-logging/cluster-logging-rhel9-operator" \
+        com.redhat.component="cluster-logging-operator-container" \
+        io.openshift.maintainer.product="OpenShift Container Platform"
diff --git a/Makefile b/Makefile
index e3e35a1f41..9ea9440c75 100644
--- a/Makefile
+++ b/Makefile
@@ -146,10 +146,16 @@ clean:
 spotless: clean
 	go clean -cache -testcache
 
+ifeq ($(shell uname -sm),Darwin arm64)
+DOCKERFILE?=Dockerfile.macos-dev
+else
+DOCKERFILE?=Dockerfile
+endif
+
 .PHONY: image
 image: .target/image
-.target/image: .target $(GEN_TIMESTAMP) $(shell find must-gather version bundle .bingo api internal -type f 2>/dev/null) Dockerfile  go.mod go.sum
-	podman build -t $(IMAGE_TAG) . -f Dockerfile
+.target/image: .target $(GEN_TIMESTAMP) $(shell find must-gather version bundle .bingo api internal -type f 2>/dev/null) $(DOCKERFILE)  go.mod go.sum
+	podman build -t $(IMAGE_TAG) . -f $(DOCKERFILE)
 	touch $@
 
 # Notes:
diff --git a/hack/deploy-image.sh b/hack/deploy-image.sh
index 0fa56bdaec..e657e2eea1 100755
--- a/hack/deploy-image.sh
+++ b/hack/deploy-image.sh
@@ -1,18 +1,35 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -euo pipefail
 
 echo "Setting up port-forwarding to remote registry ..."
-coproc oc -n openshift-image-registry port-forward service/image-registry 5000:5000
+coproc oc -n openshift-image-registry port-forward --address 0.0.0.0 service/image-registry 5000:5000
 trap "kill -15 $COPROC_PID" EXIT
 read PORT_FORWARD_STDOUT <&"${COPROC[0]}"
 if [[ "$PORT_FORWARD_STDOUT" =~ ^Forwarding.*5000$ ]] ; then
+    # On macOS, podman runs in a VM and can't reach host's 127.0.0.1.
+    # Use host.containers.internal to reach the host from the VM.
+    if [[ "$(uname -s)" == "Darwin" ]]; then
+        REGISTRY_HOST="host.containers.internal"
+    else
+        REGISTRY_HOST="127.0.0.1"
+    fi
+
     user=$(oc whoami | sed s/://)
+    token=$(oc whoami -t)
     echo "Login to registry..."
-    podman login --tls-verify=false -u ${user} -p $(oc whoami -t) 127.0.0.1:5000
+    podman login --tls-verify=false -u ${user} -p ${token} 127.0.0.1:5000
+    if [[ "$(uname -s)" == "Darwin" ]]; then
+        # Copy auth entry so push inside the VM can authenticate via host.containers.internal
+        AUTH_FILE="${XDG_RUNTIME_DIR:-${HOME}/.config}/containers/auth.json"
+        if [[ -f "${AUTH_FILE}" ]]; then
+            jq '.auths["host.containers.internal:5000"] = .auths["127.0.0.1:5000"]' "${AUTH_FILE}" > "${AUTH_FILE}.tmp" && mv "${AUTH_FILE}.tmp" "${AUTH_FILE}"
+        fi
+    fi
 
-    echo "Pushing image ${IMAGE_TAG} ..."
-    if podman push --tls-verify=false ${IMAGE_TAG} ; then
+    PUSH_TAG="${IMAGE_TAG/127.0.0.1/${REGISTRY_HOST}}"
+    echo "Pushing image ${IMAGE_TAG} to ${PUSH_TAG} ..."
+    if podman push --tls-verify=false ${IMAGE_TAG} ${PUSH_TAG} ; then
         oc -n openshift get imagestreams | grep cluster-logging-operator
     fi
 else
diff --git a/olm_deploy/scripts/catalog-build.sh b/olm_deploy/scripts/catalog-build.sh
index 87dac44eeb..5d4d25b400 100755
--- a/olm_deploy/scripts/catalog-build.sh
+++ b/olm_deploy/scripts/catalog-build.sh
@@ -1,20 +1,31 @@
-#!/bin/sh -x
+#!/usr/bin/env bash
 set -eo pipefail
 
 IMAGE_CLUSTER_LOGGING_OPERATOR_REGISTRY=${IMAGE_CLUSTER_LOGGING_OPERATOR_REGISTRY:-$LOCAL_IMAGE_CLUSTER_LOGGING_OPERATOR_REGISTRY}
 echo "Building operator registry image ${IMAGE_CLUSTER_LOGGING_OPERATOR_REGISTRY}"
-podman build -f olm_deploy/operatorregistry/Dockerfile -t ${IMAGE_CLUSTER_LOGGING_OPERATOR_REGISTRY} .
+podman build --platform linux/amd64 -f olm_deploy/operatorregistry/Dockerfile -t ${IMAGE_CLUSTER_LOGGING_OPERATOR_REGISTRY} .
 
 if [ -n "${LOCAL_IMAGE_CLUSTER_LOGGING_OPERATOR_REGISTRY}" ] ; then
-    coproc oc -n openshift-image-registry port-forward service/image-registry 5000:5000
+    coproc oc -n openshift-image-registry port-forward --address 0.0.0.0 service/image-registry 5000:5000
     trap "kill -15 $COPROC_PID" EXIT
     read PORT_FORWARD_STDOUT <&"${COPROC[0]}"
     if [[ "$PORT_FORWARD_STDOUT" =~ ^Forwarding.*5000$ ]] ; then
         user=$(oc whoami | sed s/://)
-        podman login --tls-verify=false -u ${user} -p $(oc whoami -t) 127.0.0.1:5000
+        token=$(oc whoami -t)
+        podman login --tls-verify=false -u ${user} -p ${token} 127.0.0.1:5000
+        if [[ "$(uname -s)" == "Darwin" ]]; then
+            # Copy auth entry so push inside the VM can authenticate via host.containers.internal
+            AUTH_FILE="${XDG_RUNTIME_DIR:-${HOME}/.config}/containers/auth.json"
+            if [[ -f "${AUTH_FILE}" ]]; then
+                jq '.auths["host.containers.internal:5000"] = .auths["127.0.0.1:5000"]' "${AUTH_FILE}" > "${AUTH_FILE}.tmp" && mv "${AUTH_FILE}.tmp" "${AUTH_FILE}"
+            fi
+            PUSH_TAG="${IMAGE_CLUSTER_LOGGING_OPERATOR_REGISTRY/127.0.0.1/host.containers.internal}"
+            podman tag ${IMAGE_CLUSTER_LOGGING_OPERATOR_REGISTRY} ${PUSH_TAG}
+            IMAGE_CLUSTER_LOGGING_OPERATOR_REGISTRY="${PUSH_TAG}"
+        fi
     else
         echo "Unexpected message from oc port-forward: $PORT_FORWARD_STDOUT"
     fi
 fi
 echo "Pushing image ${IMAGE_CLUSTER_LOGGING_OPERATOR_REGISTRY}"
-podman push  --tls-verify=false ${IMAGE_CLUSTER_LOGGING_OPERATOR_REGISTRY}
+podman push --tls-verify=false ${IMAGE_CLUSTER_LOGGING_OPERATOR_REGISTRY}
diff --git a/olm_deploy/scripts/catalog-deploy.sh b/olm_deploy/scripts/catalog-deploy.sh
index c7eb7d2493..33366cc96c 100755
--- a/olm_deploy/scripts/catalog-deploy.sh
+++ b/olm_deploy/scripts/catalog-deploy.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env bash
 set -eou pipefail
 source $(dirname "${BASH_SOURCE[0]}")/env.sh
 
diff --git a/olm_deploy/scripts/catalog-uninstall.sh b/olm_deploy/scripts/catalog-uninstall.sh
index bc67f82774..5e7d26cbd2 100755
--- a/olm_deploy/scripts/catalog-uninstall.sh
+++ b/olm_deploy/scripts/catalog-uninstall.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env bash
 set -eou pipefail
 
 source $(dirname "${BASH_SOURCE[0]}")/env.sh
diff --git a/olm_deploy/scripts/env.sh b/olm_deploy/scripts/env.sh
index 32d2e57358..fefa7c4c96 100755
--- a/olm_deploy/scripts/env.sh
+++ b/olm_deploy/scripts/env.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env bash
 set -eou pipefail
 
 LOGGING_VERSION=${LOGGING_VERSION:-6.1}
diff --git a/olm_deploy/scripts/operator-install.sh b/olm_deploy/scripts/operator-install.sh
index 252101b75a..f5967333fe 100755
--- a/olm_deploy/scripts/operator-install.sh
+++ b/olm_deploy/scripts/operator-install.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env bash
 set -eou pipefail
 source $(dirname "${BASH_SOURCE[0]}")/env.sh
 
diff --git a/olm_deploy/scripts/operator-uninstall.sh b/olm_deploy/scripts/operator-uninstall.sh
index 2fb0b0f99a..4e877b60b0 100755
--- a/olm_deploy/scripts/operator-uninstall.sh
+++ b/olm_deploy/scripts/operator-uninstall.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env bash
 set -eou pipefail
 
 source $(dirname "${BASH_SOURCE[0]}")/env.sh
diff --git a/olm_deploy/scripts/registry-init.sh b/olm_deploy/scripts/registry-init.sh
index 6daf97ad4b..bec1cd9cbd 100755
--- a/olm_deploy/scripts/registry-init.sh
+++ b/olm_deploy/scripts/registry-init.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -eou pipefail
 source $(dirname "${BASH_SOURCE[0]}")/env.sh
diff --git a/olm_deploy/scripts/wait_for_deployment.sh b/olm_deploy/scripts/wait_for_deployment.sh
index 1d4ae6ddb0..3c1427c283 100755
--- a/olm_deploy/scripts/wait_for_deployment.sh
+++ b/olm_deploy/scripts/wait_for_deployment.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env bash
 set -eou pipefail
 
 # $1 - namespace