diff --git a/.github/workflows/dogfood.yml b/.github/workflows/dogfood.yml
index 633bcc08..8075127b 100644
--- a/.github/workflows/dogfood.yml
+++ b/.github/workflows/dogfood.yml
@@ -36,10 +36,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # Windows-only. macOS legs removed: runner starvation + untriageable
-        # mac-only failures kept the matrix red. Re-add when a Mac maintainer
-        # owns them (and pass --require win32,darwin to verify-release-readiness).
-        os: [windows-latest]
+        # The macOS leg was dropped once for runner starvation and mac-only failures nobody
+        # owned; the desktop app ships to Macs first, so it is back, and a red leg is a finding.
+        os: [windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
     env:
diff --git a/.github/workflows/suites-matrix.yml b/.github/workflows/suites-matrix.yml
new file mode 100644
index 00000000..7050001d
--- /dev/null
+++ b/.github/workflows/suites-matrix.yml
@@ -0,0 +1,68 @@
+name: Suites on every OS
+
+# The three suites (backend pytest, frontend, electron) used to run only on one developer's Mac;
+# CI ran a hermetic subset on Ubuntu. Users run a 2017 iMac, Intel Macs and Windows laptops, so the
+# full suites run on the three hosted OSes. fail-fast is off and every suite runs even after a red
+# one, so one run reports all nine verdicts.
+on:
+  workflow_dispatch:
+  push:
+    branches: [eric/dev, main]
+
+concurrency:
+  group: suites-matrix-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  suites:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, macos-15-intel, windows-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
+    env:
+      OSW_NEVER_KILL_ROUTER: '1'
+      OSW_DISABLE_AUTO_RESUME: '1'
+      CSC_IDENTITY_AUTO_DISCOVERY: 'false'
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'
+          cache: pip
+          cache-dependency-path: backend/requirements.lock
+
+      - name: Backend dependencies (the locked set users get, plus the test runner)
+        run: |
+          pip install -r backend/requirements.lock
+          pip install -r backend/requirements-dev.txt
+
+      - name: Backend suite
+        shell: bash
+        run: python -m pytest backend/tests -q -p no:cacheprovider
+
+      - uses: actions/setup-node@v4
+        if: always()
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: |
+            frontend/package-lock.json
+            electron/package-lock.json
+
+      - name: Frontend suite
+        if: always()
+        shell: bash
+        working-directory: frontend
+        run: npm ci && npm test
+
+      - name: Electron suite
+        if: always()
+        shell: bash
+        working-directory: electron
+        run: npm ci && npm test