diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d23cf89..a7d577c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,12 +14,27 @@ jobs:
     name: Build for ${{ matrix.target }}
     runs-on: ${{ matrix.os }}
     strategy:
+      fail-fast: false
       matrix:
         include:
           - target: x86_64-unknown-linux-gnu
             os: ubuntu-22.04
+            ext: ""
           - target: aarch64-unknown-linux-gnu
             os: ubuntu-22.04-arm
+            ext: ""
+          # macos-13 is the last Intel-host runner image; once GitHub retires
+          # it, switch this entry to `os: macos-14` and add
+          # `--target x86_64-apple-darwin` cross-compile (Rosetta-host build).
+          - target: x86_64-apple-darwin
+            os: macos-13
+            ext: ""
+          - target: aarch64-apple-darwin
+            os: macos-14
+            ext: ""
+          - target: x86_64-pc-windows-msvc
+            os: windows-latest
+            ext: ".exe"
 
     steps:
       - name: Checkout
@@ -39,19 +54,47 @@ jobs:
         run: cargo build --release --target ${{ matrix.target }}
 
       - name: Rename binary
+        shell: bash
         run: |
           PACKAGE_NAME=$(cargo metadata --no-deps --format-version 1 | jq -r ".packages[0].name")
-          cp "target/${{ matrix.target }}/release/${PACKAGE_NAME}" "${PACKAGE_NAME}-${{ matrix.target }}"
+          cp "target/${{ matrix.target }}/release/${PACKAGE_NAME}${{ matrix.ext }}" "${PACKAGE_NAME}-${{ matrix.target }}${{ matrix.ext }}"
 
       - name: Upload artifact
         uses: actions/upload-artifact@v4
         with:
           name: binary-${{ matrix.target }}
-          path: opendeck-rotary-generic-${{ matrix.target }}
+          path: opendeck-rotary-generic-${{ matrix.target }}${{ matrix.ext }}
           compression-level: 0
 
-  package:
+  macos-universal:
+    name: Lipo macOS universal binary
     needs: build
+    runs-on: macos-14
+    steps:
+      - name: Download macOS binaries
+        uses: actions/download-artifact@v4
+        with:
+          pattern: binary-*-apple-darwin
+          path: macos
+          merge-multiple: true
+
+      - name: Create universal binary
+        run: |
+          lipo -create \
+            macos/opendeck-rotary-generic-x86_64-apple-darwin \
+            macos/opendeck-rotary-generic-aarch64-apple-darwin \
+            -output opendeck-rotary-generic-universal-apple-darwin
+          lipo -info opendeck-rotary-generic-universal-apple-darwin
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: binary-universal-apple-darwin
+          path: opendeck-rotary-generic-universal-apple-darwin
+          compression-level: 0
+
+  package:
+    needs: [build, macos-universal]
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -67,7 +110,14 @@ jobs:
         run: |
           mkdir -p "${UUID}.sdPlugin"
           cp -r assets/* "${UUID}.sdPlugin/"
+          # Universal supersedes the per-arch macOS slices; keep payload small.
+          rm -f binaries/opendeck-rotary-generic-x86_64-apple-darwin \
+                binaries/opendeck-rotary-generic-aarch64-apple-darwin
           cp binaries/* "${UUID}.sdPlugin/"
+          for f in "${UUID}.sdPlugin/"opendeck-rotary-generic-*-unknown-linux-gnu \
+                   "${UUID}.sdPlugin/"opendeck-rotary-generic-universal-apple-darwin; do
+            [ -f "$f" ] && chmod +x "$f"
+          done
           zip -r "${UUID}.zip" "${UUID}.sdPlugin"
 
       - name: Upload package
diff --git a/Cargo.lock b/Cargo.lock
index 383d12d..1c51cbf 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2,12 +2,6 @@
 # It is not intended for manual editing.
 version = 4
 
-[[package]]
-name = "anyhow"
-version = "1.0.102"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
-
 [[package]]
 name = "async-trait"
 version = "0.1.89"
@@ -291,9 +285,8 @@ dependencies = [
 
 [[package]]
 name = "opendeck-rotary-generic"
-version = "0.1.0"
+version = "0.2.0"
 dependencies = [
- "anyhow",
  "dashmap",
  "log",
  "openaction",
diff --git a/Cargo.toml b/Cargo.toml
index f9b6b16..0ee617a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,11 +1,10 @@
 [package]
 name = "opendeck-rotary-generic"
-version = "0.1.0"
+version = "0.2.0"
 edition = "2024"
 license = "MIT"
 
 [dependencies]
-anyhow = "1.0"
 dashmap = "6"
 log = "0.4"
 openaction = "2.6"
diff --git a/README.md b/README.md
index 316ada3..6e98ca8 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@
 | Clockwise rotation | CW command |
 | Counter-clockwise rotation | CCW command |
 | Short press | Press command |
-| Long press (> 500 ms) | Long press command |
+| Long press (> 750 ms, fires on threshold) | Long press command |
 
 All four commands are configured per-instance via the property inspector.
 
@@ -17,9 +17,10 @@ All four commands are configured per-instance via the property inspector.
 
 Download `info.degois.damien.opendeck.plugins.rotary-command.zip` from the [releases page](../../releases) and install it through OpenDeck.
 
-### From source
+### From source (Linux)
 
-Requires Rust toolchain.
+Requires the Rust toolchain. The supplied Makefile only knows the Linux XDG
+plugin path; macOS and Windows users should install from the release zip.
 
 ```sh
 make install
@@ -37,6 +38,10 @@ make clean            # remove build artifacts
 
 Cross-compile with `TARGET=aarch64-unknown-linux-gnu make build`.
 
+> **Note on logging.** Shell commands are echoed to the log stream at debug
+> level (`RUST_LOG=debug`). Avoid embedding secrets directly in the command —
+> read them from a file or environment variable instead.
+
 ## Example
 
 Volume control via PipeWire:
@@ -50,7 +55,7 @@ Volume control via PipeWire:
 
 ## Acknowledgments
 
-CI workflow inspired by [OpenActionPlugins/mpris](https://github.com/OpenActionPlugins/mpris).
+CI workflow originally inspired by [OpenActionPlugins/mpris](https://github.com/OpenActionPlugins/mpris); since extended for cross-platform builds and a macOS universal binary.
 
 ## License
 
diff --git a/assets/manifest.json b/assets/manifest.json
index bb249c5..a052b0b 100644
--- a/assets/manifest.json
+++ b/assets/manifest.json
@@ -2,17 +2,24 @@
 	"Name": "Rotary Generic Command",
 	"Description": "Run custom shell commands on rotary encoder actions (CW, CCW, press, long press)",
 	"Author": "babs",
-	"Version": "0.1.0",
+	"Version": "0.2.0",
 	"Icon": "icons/plugin",
-	"Category": "Custom",
+	"Category": "Rotary Encoder",
 	"SDKVersion": 2,
 	"OS": [
-		{ "Platform": "linux" }
+		{ "Platform": "linux" },
+		{ "Platform": "mac" },
+		{ "Platform": "windows" }
 	],
 	"CodePathLin": "opendeck-rotary-generic-x86_64-unknown-linux-gnu",
+	"CodePathMac": "opendeck-rotary-generic-universal-apple-darwin",
+	"CodePathWin": "opendeck-rotary-generic-x86_64-pc-windows-msvc.exe",
 	"CodePaths": {
 		"x86_64-unknown-linux-gnu": "opendeck-rotary-generic-x86_64-unknown-linux-gnu",
-		"aarch64-unknown-linux-gnu": "opendeck-rotary-generic-aarch64-unknown-linux-gnu"
+		"aarch64-unknown-linux-gnu": "opendeck-rotary-generic-aarch64-unknown-linux-gnu",
+		"x86_64-apple-darwin": "opendeck-rotary-generic-universal-apple-darwin",
+		"aarch64-apple-darwin": "opendeck-rotary-generic-universal-apple-darwin",
+		"x86_64-pc-windows-msvc": "opendeck-rotary-generic-x86_64-pc-windows-msvc.exe"
 	},
 	"Actions": [
 		{
diff --git a/assets/propertyInspector/rotary.html b/assets/propertyInspector/rotary.html
index 7017b83..ad88bcd 100644
--- a/assets/propertyInspector/rotary.html
+++ b/assets/propertyInspector/rotary.html
@@ -64,7 +64,7 @@
 	<div class="field">
 		<label for="long_press_command">Long Press Command</label>
 		<input type="text" id="long_press_command" placeholder="e.g. pavucontrol" />
-		<div class="hint">Shell command to run on long press (hold &gt; 500ms).</div>
+		<div class="hint">Shell command to run on long press (hold &gt; 750ms; fires as soon as the threshold is reached).</div>
 	</div>
 
 <script>
diff --git a/src/main.rs b/src/main.rs
index dc52865..96c4810 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -4,8 +4,14 @@ use openaction::{register_action, run};
 
 #[tokio::main]
 async fn main() {
+	// Honor RUST_LOG as a plain level (off|error|warn|info|debug|trace); the
+	// README documents this knob for command-echo debug logging.
+	let level = std::env::var("RUST_LOG")
+		.ok()
+		.and_then(|s| s.parse::<log::LevelFilter>().ok())
+		.unwrap_or(log::LevelFilter::Info);
 	if let Err(e) = simplelog::TermLogger::init(
-		log::LevelFilter::Info,
+		level,
 		simplelog::Config::default(),
 		simplelog::TerminalMode::Stdout,
 		simplelog::ColorChoice::Never,
diff --git a/src/rotary.rs b/src/rotary.rs
index 910d352..8a71d3a 100644
--- a/src/rotary.rs
+++ b/src/rotary.rs
@@ -1,13 +1,17 @@
-use std::process::Command;
-use std::time::{Duration, Instant};
+use std::process::Stdio;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::time::Duration;
 
 use dashmap::DashMap;
 use openaction::{Instance, InstanceId, OpenActionResult, async_trait};
 use serde::{Deserialize, Serialize};
+use tokio::process::Command;
+use tokio::task::JoinHandle;
 
-const LONG_PRESS_THRESHOLD: Duration = Duration::from_millis(500);
+const LONG_PRESS_THRESHOLD: Duration = Duration::from_millis(750);
 
-#[derive(Serialize, Deserialize, Clone)]
+#[derive(Serialize, Deserialize, Clone, Default)]
 #[serde(default)]
 pub struct RotarySettings {
 	/// Shell command to run on clockwise rotation.
@@ -20,51 +24,113 @@ pub struct RotarySettings {
 	pub long_press_command: String,
 }
 
-impl Default for RotarySettings {
-	fn default() -> Self {
-		Self {
-			cw_command: String::new(),
-			ccw_command: String::new(),
-			press_command: String::new(),
-			long_press_command: String::new(),
-		}
-	}
+struct PressState {
+	long_press_fired: Arc<AtomicBool>,
+	long_press_task: JoinHandle<()>,
 }
 
+#[derive(Default)]
 pub struct RotaryAction {
-	press_starts: DashMap<InstanceId, Instant>,
+	press_states: DashMap<InstanceId, PressState>,
 }
 
 impl RotaryAction {
 	pub fn new() -> Self {
-		Self {
-			press_starts: DashMap::new(),
+		Self::default()
+	}
+
+	/// Cancel any in-flight long-press timer for `id` and drop its state.
+	fn cancel_press(&self, id: &InstanceId) {
+		if let Some((_, state)) = self.press_states.remove(id) {
+			state.long_press_task.abort();
 		}
 	}
 }
 
-fn run_command(label: &str, cmd: &str) {
-	if cmd.is_empty() {
+#[cfg(unix)]
+fn is_flatpak() -> bool {
+	use std::env::var;
+	var("FLATPAK_ID").is_ok()
+		|| var("container")
+			.map(|x| x.to_lowercase().trim() == "flatpak")
+			.unwrap_or(false)
+}
+
+#[cfg(unix)]
+fn path_has(bin: &str) -> bool {
+	use std::os::unix::fs::PermissionsExt;
+	std::env::var_os("PATH")
+		.map(|p| {
+			std::env::split_paths(&p).any(|d| {
+				std::fs::metadata(d.join(bin))
+					.map(|m| m.is_file() && m.permissions().mode() & 0o111 != 0)
+					.unwrap_or(false)
+			})
+		})
+		.unwrap_or(false)
+}
+
+#[cfg(unix)]
+fn is_distrobox() -> bool {
+	// Heuristic shared with OpenDeck's Run Command, but only useful when the
+	// host-exec helper is actually reachable; toolbx and plain podman set the
+	// same env var without shipping it.
+	std::env::var("CONTAINER_ID").is_ok() && path_has("distrobox-host-exec")
+}
+
+#[cfg(unix)]
+fn build_command(value: &str) -> Command {
+	let trimmed = value.trim();
+	let mut cmd = if is_flatpak() {
+		let mut c = Command::new("flatpak-spawn");
+		c.args(["--host", "sh", "-c", value]);
+		c
+	} else if is_distrobox() && !trimmed.starts_with("distrobox-host-exec") {
+		let mut c = Command::new("distrobox-host-exec");
+		c.args(["sh", "-c", value]);
+		c
+	} else {
+		let mut c = Command::new("sh");
+		c.args(["-c", value]);
+		c
+	};
+	if let Some(home) = std::env::home_dir() {
+		cmd.current_dir(home);
+	}
+	// Null stdin: a child shell reading stdin would steal bytes from our IPC.
+	cmd.stdin(Stdio::null());
+	cmd
+}
+
+#[cfg(windows)]
+fn build_command(value: &str) -> Command {
+	use std::os::windows::process::CommandExt;
+	let mut cmd = Command::new("cmd");
+	cmd.arg("/C");
+	cmd.raw_arg(value);
+	if let Some(home) = std::env::home_dir() {
+		cmd.current_dir(home);
+	}
+	cmd.stdin(Stdio::null());
+	cmd
+}
+
+fn run_command(label: &str, cmd_str: &str) {
+	if cmd_str.trim().is_empty() {
 		return;
 	}
-	log::debug!("{label}: running command: {cmd}");
-	let cmd = cmd.to_string();
+	log::debug!("{label}: running command: {cmd_str}");
+	let cmd_str = cmd_str.to_string();
 	let label = label.to_string();
 	tokio::spawn(async move {
-		let label2 = label.clone();
-		let result = tokio::task::spawn_blocking(move || {
-			Command::new("/bin/sh").args(["-c", &cmd]).output()
-		})
-		.await;
-		match result {
-			Ok(Ok(output)) => {
+		match build_command(&cmd_str).output().await {
+			Ok(output) => {
 				if !output.status.success() {
 					let stderr = String::from_utf8_lossy(&output.stderr);
-					log::error!("{label2} command failed: {stderr}");
+					log::error!("{label} command failed: {stderr}");
 				}
 			}
-			Ok(Err(e)) => log::error!("{label2} command error: {e}"),
-			Err(e) => log::error!("{label2} task join error: {e}"),
+			Err(e) => log::error!("{label} command error: {e}"),
 		}
 	});
 }
@@ -87,9 +153,10 @@ impl openaction::Action for RotaryAction {
 		_instance: &Instance,
 		settings: &Self::Settings,
 		ticks: i16,
+		// `_pressed` (rotation while held) is not exposed as a separate trigger
+		// for parity with OpenDeck's Run Command; combined gestures fire CW/CCW.
 		_pressed: bool,
 	) -> OpenActionResult<()> {
-		// Run the appropriate command once per event (ticks sign gives direction)
 		if ticks > 0 {
 			run_command("cw", &settings.cw_command);
 		} else if ticks < 0 {
@@ -101,10 +168,35 @@ impl openaction::Action for RotaryAction {
 	async fn dial_down(
 		&self,
 		instance: &Instance,
-		_settings: &Self::Settings,
+		settings: &Self::Settings,
 	) -> OpenActionResult<()> {
-		self.press_starts
-			.insert(instance.instance_id.clone(), Instant::now());
+		// dial_up races the timer's compare_exchange on long_press_fired —
+		// exactly one path wins, and the timer fires on threshold for feedback.
+		let id = instance.instance_id.clone();
+
+		// Dropping a JoinHandle does NOT cancel the task; abort prior timer
+		// before reinstall, otherwise a duplicate dial_down leaks it.
+		self.cancel_press(&id);
+
+		let long_press_cmd = settings.long_press_command.clone();
+		let fired = Arc::new(AtomicBool::new(false));
+		let fired_timer = fired.clone();
+		let task = tokio::spawn(async move {
+			tokio::time::sleep(LONG_PRESS_THRESHOLD).await;
+			if fired_timer
+				.compare_exchange(false, true, Ordering::SeqCst, Ordering::SeqCst)
+				.is_ok()
+			{
+				run_command("long_press", &long_press_cmd);
+			}
+		});
+		self.press_states.insert(
+			id,
+			PressState {
+				long_press_fired: fired,
+				long_press_task: task,
+			},
+		);
 		Ok(())
 	}
 
@@ -113,15 +205,13 @@ impl openaction::Action for RotaryAction {
 		instance: &Instance,
 		settings: &Self::Settings,
 	) -> OpenActionResult<()> {
-		let elapsed = self
-			.press_starts
-			.remove(&instance.instance_id)
-			.map(|(_, start)| start.elapsed())
-			.unwrap_or(Duration::ZERO);
-
-		if elapsed >= LONG_PRESS_THRESHOLD {
-			run_command("long_press", &settings.long_press_command);
-		} else {
+		if let Some((_, state)) = self.press_states.remove(&instance.instance_id)
+			&& state
+				.long_press_fired
+				.compare_exchange(false, true, Ordering::SeqCst, Ordering::SeqCst)
+				.is_ok()
+		{
+			state.long_press_task.abort();
 			run_command("press", &settings.press_command);
 		}
 		Ok(())
@@ -134,4 +224,14 @@ impl openaction::Action for RotaryAction {
 	) -> OpenActionResult<()> {
 		Ok(())
 	}
+
+	async fn will_disappear(
+		&self,
+		instance: &Instance,
+		_settings: &Self::Settings,
+	) -> OpenActionResult<()> {
+		// Reclaim press state so an orphan timer can't fire against a removed instance.
+		self.cancel_press(&instance.instance_id);
+		Ok(())
+	}
 }