diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 20d77697..19ebcd04 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -116,7 +116,12 @@ jobs:
           ninja -C build
 
   macos:
-    runs-on: macos-11
+    strategy:
+      matrix:
+        include:
+        - os: macos-11
+        - os: macos-12
+    runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v3
         with:
@@ -124,15 +129,11 @@ jobs:
       - name: Set up dependencies
         run: |
           brew install meson
-      - name: Build macOS universal
-        env:
-          CFLAGS: -mmacosx-version-min=10.12 -DMAC_OS_X_VERSION_MAX_ALLOWED=MAC_OS_X_VERSION_10_12 -DMAC_OS_X_VERSION_MIN_REQUIRED=MAC_OS_X_VERSION_10_12
-          CXXFLAGS: -mmacosx-version-min=10.12 -DMAC_OS_X_VERSION_MAX_ALLOWED=MAC_OS_X_VERSION_10_12 -DMAC_OS_X_VERSION_MIN_REQUIRED=MAC_OS_X_VERSION_10_12
-          LDFLAGS: -mmacosx-version-min=10.12
+      - name: Build
         run: |
           meson build --buildtype=release --prefix=/usr -Dbuild-universal=true
           ninja -C build
-      - name: Install macOS universal
+      - name: Install
         run: |
           ninja -C build install
       - name: Set sha8 (release)
@@ -148,9 +149,18 @@ jobs:
           tar czf ${{ github.event.repository.name }}-macos-${{ github.event.pull_request.number || env.SHA8 }}.tar.gz -C ${{ env.DESTDIR }}/usr/lib lv2 vst vst3
       - uses: actions/upload-artifact@v3
         with:
-          name: ${{ github.event.repository.name }}-macos-${{ github.event.pull_request.number || env.SHA8 }}
+          name: ${{ github.event.repository.name }}-${{ matrix.os }}-${{ github.event.pull_request.number || env.SHA8 }}
           path: |
             *.tar.gz
+      - uses: softprops/action-gh-release@v1
+        if: ${{ matrix.os == 'macos-11' && startsWith(github.ref, 'refs/tags/') }}
+        with:
+          tag_name: ${{ github.ref_name }}
+          name: ${{ github.ref_name }}
+          draft: false
+          prerelease: false
+          files: |
+            *.tar.gz
 
   windows:
     strategy:
diff --git a/meson.build b/meson.build
index b71b6210..3d505ec1 100644
--- a/meson.build
+++ b/meson.build
@@ -152,6 +152,7 @@ if not os_darwin
     ]
 endif
 
+# FIXME check for clang instead
 if not (os_darwin or os_windows)
     build_flags += [
         '-fno-gnu-unique'
@@ -233,6 +234,9 @@ if os_darwin
     build_flags += [
         '-DMAC=1',
         '-DGL_SILENCE_DEPRECATION=1',
+        '-DMAC_OS_X_VERSION_MAX_ALLOWED=MAC_OS_X_VERSION_10_15',
+        '-DMAC_OS_X_VERSION_MIN_REQUIRED=MAC_OS_X_VERSION_10_15',
+        '-mmacosx-version-min=10.15',
     ]
     build_flags_cpp += [
         '-ObjC++',
@@ -251,17 +255,15 @@ elif os_windows
     build_flags_cpp += [
         '-fpermissive',
     ]
-elif linux_headless
-    build_flags += [
-        '-DLINUX=1',
-    ]
-    build_flags_cpp += [
-        '-DJUCE_AUDIOPROCESSOR_NO_GUI=1',
-    ]
 else
     build_flags += [
         '-DLINUX=1',
     ]
+    if linux_headless
+        build_flags_cpp += [
+            '-DJUCE_AUDIOPROCESSOR_NO_GUI=1',
+        ]
+    endif
 endif
 
 ###############################################################################
@@ -287,18 +289,25 @@ if lto_optimizations
 endif
 
 if os_darwin
+    link_flags += [
+        '-mmacosx-version-min=10.15',
+    ]
+    link_flags_release += [
+        '-Wl,-dead_strip,-dead_strip_dylibs,-x',
+    ]
     if build_universal
         link_flags += [
             '-arch', 'x86_64',
             '-arch', 'arm64',
         ]
     endif
-    link_flags_release += [
-        '-Wl,-dead_strip,-dead_strip_dylibs,-x',
-    ]
 elif os_windows
     link_flags += [
         '-static',
+        '-Wl,--as-needed,--no-undefined',
+    ]
+    link_flags_release += [
+        '-Wl,-O1,--gc-sections,--strip-all',
     ]
 else
     link_flags += [