diff --git a/tools/build/install_fs_pruned.sh b/tools/build/install_fs_pruned.sh
index acc162998..12a60d3ea 100755
--- a/tools/build/install_fs_pruned.sh
+++ b/tools/build/install_fs_pruned.sh
@@ -15,14 +15,16 @@ else THIS_SCRIPT="${BASH_SOURCE[0]}"
 fi
 # Link where to find the FreeSurfer tarball:
 fslink="default"
+insecure="false"
 
 if [[ "$#" -lt 1 ]]; then
     echo
-    echo "Usage: install_fs_pruned.sh install_dir [--upx] [--url freesurfer_download_url]"
+    echo "Usage: install_fs_pruned.sh install_dir [--upx] [--url freesurfer_download_url] [--insecure]"
     echo 
     echo "--upx is optional, if passed, fs/bin will be packed"
     echo "--url is recommended! This is the download link for freesurfer."
     echo "  The link can be found in pyproject.toml:tool.freesurfer.url!"
+    echo "--insecure will skip certificate checks when downloading freesurfer."
     echo
     exit 2
 fi
@@ -39,6 +41,7 @@ while [[ "$#" -ge 1 ]]; do
   case $lowercase in
   --upx) upx="true" ; shift ;;
   --url) fslink=$2 ; shift ; shift ;;
+  --insecure) insecure="true" ; shift ;;
   *) echo "Invalid argument $1" ; exit 1 ;;
   esac
 done
@@ -99,9 +102,17 @@ if [[ -f "$freesurfer_dl" ]] ; then
   echo "Found cached download $freesurfer_dl, using that ..."
 else
   # dl aria2c if that exists, else wget or curl
-  if [[ -n "$(which aria2c)" ]] ; then dl=(aria2c -cx 16 -s 16 --check-certificate=false -o "$freesurfer_dl" "$fslink")
-  elif [[ -n "$(which wget)" ]] ; then dl=(wget --no-check-certificate -qO- "$fslink" -O "$freesurfer_dl")
-  else dl=(curl -L --insecure "$fslink" -o "$freesurfer_dl")
+  cert=()
+  if [[ -n "$(which aria2c)" ]] ; then
+    if [[ "$insecure" == "true" ]] ; then cert=("--check-certificate=false") ; fi
+    # shellcheck disable=SC2206
+    dl=(aria2c -c -x 16 -s 16 "${cert[@]}" -o "$freesurfer_dl" "$fslink")
+  elif [[ -n "$(which wget)" ]] ; then
+    if [[ "$insecure" == "true" ]] ; then cert=("--no-check-certificate") ; fi
+    dl=(wget "${cert[@]}" -qO- "$fslink" -O "$freesurfer_dl")
+  else
+    if [[ "$insecure" == "true" ]] ; then cert=("--insecure") ; fi
+    dl=(curl -L "${cert[@]}" "$fslink" -o "$freesurfer_dl")
   fi
 
   echo "Downloading FreeSurfer from $fslink with ${dl[0]}..."
@@ -110,7 +121,8 @@ fi
 
 
 if [[ ! -f "$freesurfer_dl" ]] ; then
-  echo "ERROR: Downloading FreeSurfer failed! This is not recoverable, see message above and retry!"
+  echo "ERROR: Downloading FreeSurfer failed, maybe due to a certificate error (consider --insecure)!"
+  echo "  This is not recoverable, see message above and retry!"
   exit 1
 fi
 
diff --git a/tools/macos_build/build_release_package.sh b/tools/macos_build/build_release_package.sh
index dca74a573..a6b305908 100755
--- a/tools/macos_build/build_release_package.sh
+++ b/tools/macos_build/build_release_package.sh
@@ -72,6 +72,8 @@ sed -e "s|<fastsurfer_home_dir>|${PATH_TO_FASTSURFER}|g" \
     -e "s|<homebrew_dir>|$HOMEBREW_DIR|g" \
     < "$SCRIPTS_DIR/postinstall.sh.template" \
     > "$SCRIPTS_DIR/postinstall"
+# copy link_fs script (do not keep double copies, so delete after build)
+cp "$tools_dir/build/link_fs.sh" "$SCRIPTS_DIR/link_fs.sh"
 
 chmod +x "$SCRIPTS_DIR/postinstall"
 
@@ -129,8 +131,10 @@ mkdir -p "$build_dir/installer"
 productbuild \
     --distribution "$DISTRIBUTION_FILE" \
     --resources "$RESOURCES_DIR" \
-    --package-path $build_dir/raw_package \
+    --package-path "$build_dir/raw_package" \
     "$INSTALLER_PKG"
 
 # get rid of temporary folder
 rm -rf "$STAGED_DIR" "$RESOURCES_DIR" "$build_dir/dist" "$build_dir/build"
+# remove the previously copied link_fs.sh script
+rm "$SCRIPTS_DIR/link_fs.sh"
diff --git a/tools/macos_build/scripts/link_fs.sh b/tools/macos_build/scripts/link_fs.sh
deleted file mode 100755
index 1d737ad81..000000000
--- a/tools/macos_build/scripts/link_fs.sh
+++ /dev/null
@@ -1,75 +0,0 @@
-#!/usr/bin/env bash
-
-# usage: link_fs.sh [<path-to-python-interpreter> [<FREESURFER_HOME>]]
-
-if [[ "$#" -gt 0 ]] && { [[ "${*/-h/}" != "$*" ]] || [[ "${*/--help/}" != "$*" ]] ; } ; then
-  echo "usage: $0 [<path-to-python-interpreter> [<FREESURFER_HOME>]]"
-  exit 0
-elif [[ "$#" == 1 ]] || [[ "$#" == 2 ]]
-then
-  if [[ ! -e "$1" ]] ; then echo "ERROR: $1 does not exist!" ; exit 1 ; fi
-  PYTHON="$1"
-  if [[ "$#" == 2 ]] ; then FREESURFER_HOME="$2" ; fi
-else
-  PYTHON=$(which python3)
-fi
-if [[ -z "$FREESURFER_HOME" ]] || [[ ! -d "$FREESURFER_HOME" ]]
-then
-  echo "ERROR: FREESURFER_HOME not defined correctly!"
-  exit 1
-fi
-
-# FS calls these for version info, but we don't need them
-# so we link them to not_here.sh (created below) to save space.
-link_files="
-  bin/mri_and
-  bin/mri_aparc2aseg
-  bin/mri_ca_label
-  bin/mri_ca_normalize
-  bin/mri_ca_register
-  bin/mri_compute_overlap
-  bin/mri_compute_seg_overlap
-  bin/mri_em_register
-  bin/mri_fwhm
-  bin/mri_gcut
-  bin/mri_log_likelihood
-  bin/mri_motion_correct.fsl
-  bin/mri_normalize_tp2
-  bin/mri_or
-  bin/mri_relabel_nonwm_hypos
-  bin/mri_remove_neck
-  bin/mri_stats2seg
-  bin/mri_surf2vol
-  bin/mri_surfcluster
-  bin/mri_voldiff
-  bin/mri_watershed
-  bin/mris_divide_parcellation
-  bin/mris_left_right_register
-  bin/mris_surface_stats
-  bin/mris_thickness
-  bin/mris_thickness_diff
-  bin/nu_correct
-  bin/tkregister2_cmdl"
-
-# create target for link with ERROR message if called
-ltrg=$FREESURFER_HOME/bin/not-here.sh
-echo '#!/bin/bash
-if [ "$1" == "-all-info" ]; then
-  echo "$0 not included ..."
-  exit 0
-fi
-echo
-echo "ERROR: The binary $0 is not included, your call is forwarded to not-here.sh"
-echo
-exit 1
-' > $ltrg
-chmod a+x $ltrg
-echo
-for file in $link_files
-do
-  echo "linking $file"
-  ln -s "$ltrg" "$FREESURFER_HOME/$file"
-done
-
-# use our python (not really needed in recon-all anyway)
-ln -sf "$PYTHON" "$FREESURFER_HOME/bin/fspython"
diff --git a/tools/macos_build/scripts/postinstall.sh.template b/tools/macos_build/scripts/postinstall.sh.template
index 4cdbc9897..0e493412e 100644
--- a/tools/macos_build/scripts/postinstall.sh.template
+++ b/tools/macos_build/scripts/postinstall.sh.template
@@ -18,7 +18,11 @@ export PYTHONPATH="${FASTSURFER_HOME}:${PYTHONPATH}"
 "$PYTHON" "$FASTSURFER_HOME/FastSurferCNN/download_checkpoints.py" --all
 
 FREESURFER_HOME="/Applications/freesurfer"
-"$SCRIPT_DIR/link_fs.sh" "$FASTSURFER_HOME/venv/bin/$PYTHON" "$FREESURFER_HOME"
+"$SCRIPT_DIR/link_fs.sh" "$FREESURFER_HOME"
+
+# use our python (not really needed in recon-all anyway)
+# TODO: soft-linking python has proven to break the python installation for the docker container
+ln -sf "$FASTSURFER_HOME/venv/bin/$PYTHON" "$FREESURFER_HOME/bin/fspython"
 
 sed -i '' -e "s|(venv)|($(basename $FASTSURFER_HOME))|g" "$FASTSURFER_HOME/venv/bin/activate"
 
diff --git a/tools/macos_build/setup.py b/tools/macos_build/setup.py
index 62fe0a37d..8b2e3b46b 100644
--- a/tools/macos_build/setup.py
+++ b/tools/macos_build/setup.py
@@ -19,4 +19,5 @@
     data_files=DATA_FILES,
     options={'py2app': OPTIONS},
     setup_requires=['py2app'],
+    py_modules=[],
 )