diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d690d1c84..d2277f97b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -30,7 +30,7 @@ jobs:
     - name: Install dependencies
       run: |
         brew install flatbuffers
-        curl -O -L -s https://installer.id.ee/media/github/opensc_0.26.1.pkg
+        curl -O -L -s https://installer.id.ee/media/github/opensc_0.27.1-3.pkg
         sudo installer -verboseR -pkg libdigidocpp-pkg/build/macos/libdigidocpp*.pkg -target /
         sudo installer -verboseR -pkg opensc_*.pkg -target /
         rm -rf libdigidocpp-pkg
@@ -41,12 +41,12 @@ jobs:
         key: vcpkg-macOS-${{ hashFiles('prepare_osx_build_environment.sh') }}
     - name: Build libraries
       run: |
-        mkdir -p ${LIBS_PATH}/Qt-6.10.3-OpenSSL
+        mkdir -p ${LIBS_PATH}/Qt-6.11.2-OpenSSL
         ./prepare_osx_build_environment.sh -p ${LIBS_PATH}
     - name: Install Qt
       uses: jurplel/install-qt-action@v4
       with:
-        version: 6.10.3
+        version: 6.11.2
         arch: clang_64
         cache: true
     - name: Build
@@ -177,14 +177,15 @@ jobs:
     - name: Install Qt
       uses: jurplel/install-qt-action@v4
       with:
-        version: 6.11.1
+        version: 6.11.2
         arch: ${{ matrix.platform == 'arm64' && 'win64_msvc2022_arm64_cross_compiled' || 'win64_msvc2022_64' }}
         cache: true
         aqtsource: git+https://github.com/miurahr/aqtinstall.git
     - name: Install WiX
       run: |
-        dotnet tool install -g wix --version 6.0.2
-        wix extension -g add WixToolset.UI.wixext/6.0.2
+        dotnet tool install -g wix --version 7.0.0
+        wix eula accept wix7
+        wix extension -g add WixToolset.UI.wixext/7.0.0
     - name: Build
       shell: cmd
       env:
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 95481f2a0..dff25fdc8 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -2,7 +2,7 @@ cmake_minimum_required(VERSION 3.22)
 if(NOT EXISTS ${CMAKE_SOURCE_DIR}/common/CMakeLists.txt)
     message(FATAL_ERROR "common submodule directory empty, did you 'git clone --recursive'?")
 endif()
-project(qdigidoc4 VERSION 4.11.0
+project(qdigidoc4 VERSION 4.12.0
     DESCRIPTION "DigiDoc4 application for digital signing and encryption"
     HOMEPAGE_URL https://github.com/open-eid/DigiDoc4-Client
 )
diff --git a/README.md b/README.md
index f7fd729de..ca030141d 100644
--- a/README.md
+++ b/README.md
@@ -64,7 +64,7 @@
 3. Configure
 
         cmake -B build -S . \
-          -DCMAKE_PREFIX_PATH=~/cmake_builds/Qt-6.11.1-OpenSSL \
+          -DCMAKE_PREFIX_PATH=~/cmake_builds/Qt-6.11.2-OpenSSL \
           -DOPENSSL_ROOT_DIR=~/cmake_build/OpenSSL \
           -DLDAP_ROOT=~/cmake_build/OpenLDAP \
           -DCMAKE_OSX_ARCHITECTURES="x86_64;arm64"
@@ -95,7 +95,7 @@
 3. Configure
 
         cmake -G"NMAKE Makefiles" -B build -S . `
-          -DCMAKE_PREFIX_PATH=C:\Qt\6.11.1\msvc2022_64 `
+          -DCMAKE_PREFIX_PATH=C:\Qt\6.11.2\msvc2022_64 `
           -DLibDigiDocpp_ROOT="C:\Program Files (x86)\libdigidocpp" `
           -DVCPKG_MANIFEST_DIR=client/libcdoc
 
diff --git a/client/CryptoDoc.cpp b/client/CryptoDoc.cpp
index a83b10d91..2ec479718 100644
--- a/client/CryptoDoc.cpp
+++ b/client/CryptoDoc.cpp
@@ -171,11 +171,6 @@ quint64 CDocumentModel::fileSize(int row) const
 	return d->files.at(row).size;
 }
 
-QString CDocumentModel::mime(int row) const
-{
-	return FileDialog::normalized(QString::fromStdString(d->files.at(row).mime));
-}
-
 void CDocumentModel::open(int row)
 {
 	if(!d->isEncrypted())
@@ -414,6 +409,7 @@ bool CryptoDoc::encrypt(const QString &filename, const QString& label, const QBy
 		return false;
 	}
 	QString writer_last_error;
+	auto keepAlive = FileDialog::keepAccessAlive(d->fileName);
 	libcdoc::result_t result = waitFor([&] -> libcdoc::result_t {
 		qCDebug(CRYPTO) << "Encrypt" << d->fileName;
 		auto writer = std::unique_ptr<libcdoc::CDocWriter>(libcdoc::CDocWriter::createWriter(d->version, d->fileName.toStdString(), &d->conf, &d->crypto, &d->network));
@@ -524,6 +520,7 @@ bool CryptoDoc::saveCopy(const QString &filename)
 	QFileInfo dst(filename);
 	if(src == dst)
 		return true;
+	auto keepAlive = FileDialog::keepAccessAlive(filename);
 	std::error_code ec;
 	std::filesystem::copy_file(src.filesystemFilePath(), dst.filesystemFilePath(),
 		std::filesystem::copy_options::overwrite_existing, ec);
diff --git a/client/CryptoDoc.h b/client/CryptoDoc.h
index 3a0c2da71..be9ca121a 100644
--- a/client/CryptoDoc.h
+++ b/client/CryptoDoc.h
@@ -89,7 +89,6 @@ class CDocumentModel final: public DocumentModel
 	bool addFile(const QString &file, const QString &mime = QStringLiteral("application/octet-stream")) final;
 	QString data(int row) const final;
 	quint64 fileSize(int row) const final;
-	QString mime(int row) const final;
 	void open(int row) final;
 	bool removeRow(int row) final;
 	int rowCount() const final;
diff --git a/client/DigiDoc.cpp b/client/DigiDoc.cpp
index 8409b55b4..329894dc8 100644
--- a/client/DigiDoc.cpp
+++ b/client/DigiDoc.cpp
@@ -333,14 +333,6 @@ quint64 SDocumentModel::fileSize(int row) const
 	return doc->b->dataFiles().at(size_t(row))->fileSize();
 }
 
-QString SDocumentModel::mime(int row) const
-{
-	if(row >= rowCount())
-		return {};
-
-	return from(doc->b->dataFiles().at(size_t(row))->mediaType());
-}
-
 bool SDocumentModel::removeRow(int row)
 {
 	if(!doc->b)
@@ -368,6 +360,7 @@ QString SDocumentModel::save(int row, const QString &path) const
 		return {};
 	if(QFileInfo::exists(path))
 		return path;
+	auto keepAlive = FileDialog::keepAccessAlive(path);
 	doc->b->dataFiles().at(size_t(row))->saveAs(path.toStdString());
 	if(!QFileInfo::exists(path))
 		return {};
@@ -710,6 +703,7 @@ bool DigiDoc::saveAs(const QString &filename)
 {
 	try
 	{
+		auto keepAlive = FileDialog::keepAccessAlive(filename);
 		return waitFor([&] {
 			parentContainer ? parentContainer->save(to(filename)) : b->save(to(filename));
 			return true;
diff --git a/client/DigiDoc.h b/client/DigiDoc.h
index 739deede2..0988e01da 100644
--- a/client/DigiDoc.h
+++ b/client/DigiDoc.h
@@ -95,7 +95,6 @@ class SDocumentModel final: public DocumentModel
 	bool addFile(const QString &file, const QString &mime = QStringLiteral("application/octet-stream")) final;
 	QString data(int row) const final;
 	quint64 fileSize(int row) const final;
-	QString mime(int row) const final;
 	bool removeRow(int row) final;
 	int rowCount() const final;
 	QString save(int row, const QString &path) const final;
diff --git a/client/DocumentModel.h b/client/DocumentModel.h
index 3dc2ae2ce..f17fef7c4 100644
--- a/client/DocumentModel.h
+++ b/client/DocumentModel.h
@@ -35,7 +35,6 @@ class DocumentModel: public QObject
 	virtual void copyModel(DocumentModel *model);
 	virtual QString data(int row) const = 0;
 	virtual quint64 fileSize(int row) const = 0;
-	virtual QString mime(int row) const = 0;
 	virtual void open(int row);
 	virtual bool removeRow(int row) = 0;
 	virtual int rowCount() const = 0;
diff --git a/client/dialogs/FileDialog.cpp b/client/dialogs/FileDialog.cpp
index f47151c36..5f4d11a3c 100644
--- a/client/dialogs/FileDialog.cpp
+++ b/client/dialogs/FileDialog.cpp
@@ -104,6 +104,25 @@ bool FileDialog::fileIsWritable( const QString &filename )
 	return result;
 }
 
+std::unique_ptr<QFile> FileDialog::keepAccessAlive(const QString &path)
+{
+#ifdef Q_OS_MACOS
+	// Qt 6.11's macOS sandbox file engine only keeps a user-selected path's
+	// security-scoped access active while some QFile instance for that exact
+	// path exists (not merely open). Code that writes to disk without going
+	// through QFile (libdigidocpp, libcdoc, std::filesystem) bypasses that
+	// entirely, so callers doing raw I/O to a save-panel-selected path must
+	// keep the object this returns alive for the duration of that write.
+	auto file = std::make_unique<QFile>(path);
+	bool opened = file->open(QFile::WriteOnly|QFile::Append);
+	Q_UNUSED(opened)
+	return file;
+#else
+	Q_UNUSED(path)
+	return {};
+#endif
+}
+
 bool FileDialog::isSignedPDF(const QString &path)
 {
 	if(!path.endsWith(QLatin1String("pdf"), Qt::CaseInsensitive))
diff --git a/client/dialogs/FileDialog.h b/client/dialogs/FileDialog.h
index cb87355ff..28e0dcf25 100644
--- a/client/dialogs/FileDialog.h
+++ b/client/dialogs/FileDialog.h
@@ -19,8 +19,11 @@
 
 #pragma once
 
+#include <QtCore/QFile>
 #include <QtWidgets/QFileDialog>
 
+#include <memory>
+
 class FileDialog : public QFileDialog
 {
 	Q_OBJECT
@@ -36,6 +39,7 @@ class FileDialog : public QFileDialog
 	static QString createNewFileName(const QString &file, bool signature, QWidget *parent);
 	static FileType detect(const QString &filename);
 	static bool fileIsWritable( const QString &filename );
+	static std::unique_ptr<QFile> keepAccessAlive(const QString &path);
 	static bool isSignedPDF(const QString &path);
 	static void setFileZone(const QString &target, const QString &source);
 	static void setReadOnly(const QString &path, bool readonly = true);
diff --git a/client/libcdoc b/client/libcdoc
index 83408f9fc..c7fe6802c 160000
--- a/client/libcdoc
+++ b/client/libcdoc
@@ -1 +1 @@
-Subproject commit 83408f9fcf4af25e81d891c34f9cc437d23f021a
+Subproject commit c7fe6802ce40c1e8a1c37662f678cf871ebd8555
diff --git a/prepare_osx_build_environment.sh b/prepare_osx_build_environment.sh
index 26c014e3e..b3d2f15cd 100755
--- a/prepare_osx_build_environment.sh
+++ b/prepare_osx_build_environment.sh
@@ -4,9 +4,9 @@
 set -e
 
 ######### Versions of libraries/frameworks to be compiled
-QT_VER="6.10.3"
+QT_VER="6.11.2"
 OPENSSL_VER="3.5.7"
-OPENLDAP_VER="2.6.13"
+OPENLDAP_VER="2.6.14"
 REBUILD=false
 BUILD_PATH=~/cmake_builds
 : ${MACOSX_DEPLOYMENT_TARGET:="14.0"}