diff --git a/client/Application.cpp b/client/Application.cpp
index e1e63012c..e731cd832 100644
--- a/client/Application.cpp
+++ b/client/Application.cpp
@@ -164,7 +164,7 @@ class DigidocConf: public digidoc::XmlConfCurrent
 	bool PKCS12Disable() const override
 	{ return s.value(QStringLiteral("PKCS12Disable"), digidoc::XmlConfCurrent::PKCS12Disable()).toBool(); }
 	std::string TSLCache() const override
-	{ return QStandardPaths::writableLocation(QStandardPaths::AppLocalDataLocation).toStdString(); }
+	{ return Application::groupContainer().toStdString(); }
 	bool TSLOnlineDigest() const override
 	{ return s.value(QStringLiteral("TSLOnlineDigest"), digidoc::XmlConfCurrent::TSLOnlineDigest()).toBool(); }
 
diff --git a/client/Application.h b/client/Application.h
index dbad1f6ef..0e5636ca8 100644
--- a/client/Application.h
+++ b/client/Application.h
@@ -75,6 +75,9 @@ class Application final: public Common
 	static QVariant confValue(ConfParameter parameter, const QVariant &value = {});
 	static void clearConfValue( ConfParameter parameter );
 	static void setConfValue( ConfParameter parameter, const QVariant &value );
+#if defined(Q_OS_MAC)
+	static QString groupContainer();
+#endif
 
 public Q_SLOTS:
 	void showAbout();
diff --git a/client/Application_mac.mm b/client/Application_mac.mm
index 95d63e5b1..718a26708 100644
--- a/client/Application_mac.mm
+++ b/client/Application_mac.mm
@@ -40,7 +40,7 @@ - (void)appReopen:(NSAppleEventDescriptor *)event withReplyEvent:(NSAppleEventDe
 	QApplication::postEvent( qApp, new REOpenEvent );
 }
 
-- (void)openClient:(NSPasteboard *)pboard userData:(NSString *)data error:(NSString **)error
+- (void)openClient:(NSPasteboard *)pboard userData:(NSString *)data error:(NSString * __autoreleasing *)error
 {
 	Q_UNUSED(data)
 	Q_UNUSED(error)
@@ -50,7 +50,7 @@ - (void)openClient:(NSPasteboard *)pboard userData:(NSString *)data error:(NSStr
 	QMetaObject::invokeMethod( qApp, "showClient", Q_ARG(QStringList,result) );
 }
 
-- (void)signClient:(NSPasteboard *)pboard userData:(NSString *)data error:(NSString **)error
+- (void)signClient:(NSPasteboard *)pboard userData:(NSString *)data error:(NSString * __autoreleasing *)error
 {
 	Q_UNUSED(data)
 	Q_UNUSED(error)
@@ -60,7 +60,7 @@ - (void)signClient:(NSPasteboard *)pboard userData:(NSString *)data error:(NSStr
 	QMetaObject::invokeMethod(qApp, "showClient", Q_ARG(QStringList,result), Q_ARG(bool,false), Q_ARG(bool,true));
 }
 
-- (void)openCrypto:(NSPasteboard *)pboard userData:(NSString *)data error:(NSString **)error
+- (void)openCrypto:(NSPasteboard *)pboard userData:(NSString *)data error:(NSString * __autoreleasing *)error
 {
 	Q_UNUSED(data)
 	Q_UNUSED(error)
@@ -77,6 +77,12 @@ - (void)openCrypto:(NSPasteboard *)pboard userData:(NSString *)data error:(NSStr
 		[NSDocumentController.sharedDocumentController noteNewRecentDocumentURL:[NSURL fileURLWithPath:file.toNSString()]];
 }
 
+QString Application::groupContainer()
+{
+	NSURL *directory = [NSFileManager.defaultManager containerURLForSecurityApplicationGroupIdentifier:@"ET847QJV9F.ee.ria.qdigidoc4.shared"];
+	return QString::fromNSString(directory.path);
+}
+
 void Application::initMacEvents()
 {
 	static bool isInitalized = false;
@@ -109,8 +115,8 @@ - (void)openCrypto:(NSPasteboard *)pboard userData:(NSString *)data error:(NSStr
 		if([appUrl.path rangeOfString:@"/Applications/Mail.app"].location != NSNotFound)
 		{
 			s << "on run" << Qt::endl
-			<< "set vattachment to \"" << q.queryItemValue("attachment") << "\"" << Qt::endl
-			<< "set vsubject to \"" << q.queryItemValue("subject") << "\"" << Qt::endl
+			<< "set vattachment to \"" << q.queryItemValue(QStringLiteral("attachment")) << "\"" << Qt::endl
+			<< "set vsubject to \"" << q.queryItemValue(QStringLiteral("subject")) << "\"" << Qt::endl
 			<< "tell application \"Mail\"" << Qt::endl
 			<< "set msg to make new outgoing message with properties {subject:vsubject, visible:true}" << Qt::endl
 			<< "tell content of msg to make new attachment with properties {file name:(vattachment as POSIX file) as alias}" << Qt::endl
@@ -121,8 +127,8 @@ - (void)openCrypto:(NSPasteboard *)pboard userData:(NSString *)data error:(NSStr
 		else if([appUrl.path rangeOfString:@"Entourage"].location != NSNotFound)
 		{
 			s << "on run" << Qt::endl
-			<< "set vattachment to \"" << q.queryItemValue("attachment") << "\"" << Qt::endl
-			<< "set vsubject to \"" << q.queryItemValue("subject") << "\"" << Qt::endl
+			<< "set vattachment to \"" << q.queryItemValue(QStringLiteral("attachment")) << "\"" << Qt::endl
+			<< "set vsubject to \"" << q.queryItemValue(QStringLiteral("subject")) << "\"" << Qt::endl
 			<< "tell application \"Microsoft Entourage\"" << Qt::endl
 			<< "set vmessage to make new outgoing message with properties" << Qt::endl
 			<< "{subject:vsubject, attachments:vattachment}" << Qt::endl
@@ -134,8 +140,8 @@ - (void)openCrypto:(NSPasteboard *)pboard userData:(NSString *)data error:(NSStr
 		else if([appUrl.path rangeOfString:@"Outlook"].location != NSNotFound)
 		{
 			s << "on run" << Qt::endl
-			<< "set vattachment to \"" << q.queryItemValue("attachment") << "\" as POSIX file" << Qt::endl
-			<< "set vsubject to \"" << q.queryItemValue("subject") << "\"" << Qt::endl
+			<< "set vattachment to \"" << q.queryItemValue(QStringLiteral("attachment")) << "\" as POSIX file" << Qt::endl
+			<< "set vsubject to \"" << q.queryItemValue(QStringLiteral("subject")) << "\"" << Qt::endl
 			<< "tell application \"Microsoft Outlook\"" << Qt::endl
 			<< "activate" << Qt::endl
 			<< "set vmessage to make new outgoing message with properties {subject:vsubject}" << Qt::endl
diff --git a/client/CMakeLists.txt b/client/CMakeLists.txt
index eda1e13dd..3501239d7 100644
--- a/client/CMakeLists.txt
+++ b/client/CMakeLists.txt
@@ -174,8 +174,8 @@ if( APPLE )
 	target_link_libraries( ${PROGNAME} "-framework Security" "-framework Quartz" "-framework Cocoa" "-fobjc-arc")
 	add_custom_command( TARGET ${PROGNAME} POST_BUILD
 		COMMAND cp -a ${PKCS11_MODULE} $<TARGET_FILE_DIR:${PROGNAME}>
-		COMMAND mkdir -p $<TARGET_BUNDLE_CONTENT_DIR:${PROGNAME}>/Library/QuickLook
-		COMMAND cp -a $<TARGET_BUNDLE_DIR:DigiDocQL> $<TARGET_BUNDLE_CONTENT_DIR:${PROGNAME}>/Library/QuickLook
+		COMMAND mkdir -p $<TARGET_BUNDLE_CONTENT_DIR:${PROGNAME}>/PlugIns
+		COMMAND cp -a $<TARGET_BUNDLE_DIR:DigiDocQL> $<TARGET_BUNDLE_CONTENT_DIR:${PROGNAME}>/PlugIns
 	)
 	add_custom_target( macdeployqt DEPENDS ${PROGNAME}
 		COMMAND ${qtCore_install_prefix}/macdeployqt $<TARGET_BUNDLE_DIR:${PROGNAME}>
@@ -195,8 +195,9 @@ if( APPLE )
 			$<TARGET_FILE_DIR:${PROGNAME}>/*.*
 			$<TARGET_BUNDLE_CONTENT_DIR:${PROGNAME}>/Frameworks/digidocpp.framework/Libraries/*
 			$<TARGET_BUNDLE_CONTENT_DIR:${PROGNAME}>/Frameworks/*.framework
-			$<TARGET_BUNDLE_CONTENT_DIR:${PROGNAME}>/PlugIns/*/*
-			$<TARGET_BUNDLE_CONTENT_DIR:${PROGNAME}>/Library/QuickLook/DigiDocQL.qlgenerator
+			$<TARGET_BUNDLE_CONTENT_DIR:${PROGNAME}>/PlugIns/*/*.dylib
+		COMMAND codesign -f -s \"$$SIGNCERT\" $<TARGET_BUNDLE_CONTENT_DIR:${PROGNAME}>/PlugIns/DigiDocQL.appex
+			--entitlements ${CMAKE_SOURCE_DIR}/extensions/DigiDocQL/PreviewViewController.entitlements
 		COMMAND if echo \"$$SIGNCERT\" | grep -q "Developer ID" \; then
 				codesign -f -s \"$$SIGNCERT\" $<TARGET_BUNDLE_DIR:${PROGNAME}> --entitlements ${CMAKE_SOURCE_DIR}/${PROGNAME}.eToken.entitlements\;
 			else
diff --git a/extensions b/extensions
index 963dfabaf..259e325cd 160000
--- a/extensions
+++ b/extensions
@@ -1 +1 @@
-Subproject commit 963dfabaf8592f0e1190dfb8697bc6bba7a3cd33
+Subproject commit 259e325cd87d2ef5fc449d88a79bf2da36282933