diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ebe8e9c..c86eb17 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,13 @@ on:
   release:
     types: [published]
 
+  workflow_dispatch:
+    inputs:
+      dryrun:
+        description: 'Run in dry-run mode (upload as artifact instead of release asset)'
+        required: true
+        type: boolean
+        default: false
 permissions: {}
 
 # Cancel in-progress runs for when multiple PRs get merged
@@ -51,7 +58,18 @@ jobs:
           EXT_PROF: ${{ secrets.CODER_DESKTOP_EXTENSION_PROVISIONPROFILE_B64 }}
         run: make release
 
+      # Upload as artifact in dry-run mode
+      - name: Upload Build Artifact
+        if: ${{ inputs.dryrun }}
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: coder-desktop-build
+          path: ${{ github.workspace }}/outputs/out
+          retention-days: 7
+
+      # Upload to release in non-dry-run mode
       - name: Upload Release Assets
+        if: ${{ !inputs.dryrun }}
         run: gh release upload "$RELEASE_TAG" "$out"/* --clobber
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -60,7 +78,7 @@ jobs:
   update-cask:
     name: Update homebrew-coder cask
     runs-on: ${{ github.repository_owner == 'coder' && 'depot-macos-latest' || 'macos-latest'}}
-    if: ${{ github.repository_owner == 'coder' }}
+    if: ${{ github.repository_owner == 'coder' && !inputs.dryrun }}
     needs: build
     steps:
       - name: Checkout
diff --git a/.gitignore b/.gitignore
index e6983d3..a1b91af 100644
--- a/.gitignore
+++ b/.gitignore
@@ -302,3 +302,6 @@ release/
 
 # marker files
 .fl5C1A396C
+
+# Embedded mutagen resources
+Coder Desktop/Resources/mutagen-*
diff --git a/Coder Desktop/Resources/.gitkeep b/Coder Desktop/Resources/.gitkeep
deleted file mode 100644
index e69de29..0000000
diff --git a/Coder Desktop/Resources/.mutagenversion b/Coder Desktop/Resources/.mutagenversion
new file mode 100644
index 0000000..f3a5a57
--- /dev/null
+++ b/Coder Desktop/Resources/.mutagenversion	
@@ -0,0 +1 @@
+v0.18.1
diff --git a/Makefile b/Makefile
index f31e8b1..259c1ce 100644
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,11 @@
+# Use bash, and immediately exit on failure
+SHELL := bash
+.SHELLFLAGS := -ceu
+
+# This doesn't work on directories.
+# See https://stackoverflow.com/questions/25752543/make-delete-on-error-for-directory-targets
+.DELETE_ON_ERROR:
+
 ifdef CI
 LINTFLAGS := --reporter github-actions-logging
 FMTFLAGS := --lint --reporter github-actions-log
@@ -11,18 +19,26 @@ XCPROJECT := Coder\ Desktop/Coder\ Desktop.xcodeproj
 SCHEME := Coder\ Desktop
 SWIFT_VERSION := 6.0
 
+MUTAGEN_RESOURCES := mutagen-agents.tar.gz mutagen-darwin-arm64 mutagen-darwin-amd64
+ifndef MUTAGEN_VERSION
+MUTAGEN_VERSION:=$(shell grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$$' $(PROJECT)/Resources/.mutagenversion)
+endif
+ifeq ($(strip $(MUTAGEN_VERSION)),)
+$(error MUTAGEN_VERSION must be a valid version)
+endif
+
 ifndef CURRENT_PROJECT_VERSION
-	CURRENT_PROJECT_VERSION:=$(shell git describe --match 'v[0-9]*' --dirty='.devel' --always --tags)
+CURRENT_PROJECT_VERSION:=$(shell git describe --match 'v[0-9]*' --dirty='.devel' --always --tags)
 endif
 ifeq ($(strip $(CURRENT_PROJECT_VERSION)),)
-	$(error CURRENT_PROJECT_VERSION cannot be empty)
+$(error CURRENT_PROJECT_VERSION cannot be empty)
 endif
 
 ifndef MARKETING_VERSION
-	MARKETING_VERSION:=$(shell git describe --match 'v[0-9]*' --tags --abbrev=0 | sed 's/^v//' | sed 's/-.*$$//')
+MARKETING_VERSION:=$(shell git describe --match 'v[0-9]*' --tags --abbrev=0 | sed 's/^v//' | sed 's/-.*$$//')
 endif
 ifeq ($(strip $(MARKETING_VERSION)),)
-	$(error MARKETING_VERSION cannot be empty)
+$(error MARKETING_VERSION cannot be empty)
 endif
 
 # Define the keychain file name first
@@ -32,10 +48,16 @@ APP_SIGNING_KEYCHAIN := $(if $(wildcard $(KEYCHAIN_FILE)),$(shell realpath $(KEY
 
 .PHONY: setup
 setup: \
+	$(addprefix $(PROJECT)/Resources/,$(MUTAGEN_RESOURCES)) \
 	$(XCPROJECT) \
 	$(PROJECT)/VPNLib/vpn.pb.swift \
 	$(PROJECT)/VPNLib/FileSync/daemon.pb.swift
 
+# Mutagen resources
+$(addprefix $(PROJECT)/Resources/,$(MUTAGEN_RESOURCES)): $(PROJECT)/Resources/.mutagenversion
+	curl -sL "https://storage.googleapis.com/coder-desktop/mutagen/$(MUTAGEN_VERSION)/$$(basename "$@")" -o "$@"
+	chmod +x "$@"
+
 $(XCPROJECT): $(PROJECT)/project.yml
 	cd $(PROJECT); \
 		SWIFT_VERSION=$(SWIFT_VERSION) \
@@ -113,7 +135,7 @@ lint/actions: ## Lint GitHub Actions
 	zizmor .
 
 .PHONY: clean
-clean: clean/project clean/keychain clean/build ## Clean project and artifacts
+clean: clean/project clean/keychain clean/build clean/mutagen ## Clean project and artifacts
 
 .PHONY: clean/project
 clean/project:
@@ -136,6 +158,10 @@ clean/keychain:
 clean/build:
 	rm -rf build/ release/ $$out
 
+.PHONY: clean/mutagen
+clean/mutagen:
+	find $(PROJECT)/Resources -name 'mutagen-*' -delete
+
 .PHONY: proto
 proto: $(PROJECT)/VPNLib/vpn.pb.swift $(PROJECT)/VPNLib/FileSync/daemon.pb.swift ## Generate Swift files from protobufs