diff --git a/deploy/pixi.toml b/deploy/pixi.toml
index 510b8f1..d89adaa 100644
--- a/deploy/pixi.toml
+++ b/deploy/pixi.toml
@@ -1,7 +1,14 @@
 [workspace]
 name = "rapida"
 channels = ["conda-forge"]
-platforms = ["linux-64", "win-64", "osx-arm64"]
+platforms = [
+    "linux-64",
+    "win-64",
+    # pyvalhalla only ships a macosx_14_0_arm64 wheel; without raising the macOS floor
+    # pixi considers it incompatible and falls back to building it from source, which
+    # fails in CMake (prime_server not found).
+    { platform = "osx-arm64", macos = "14.0" },
+]
 
 [dependencies]
 # Heavy binary geospatial drivers and libraries
diff --git a/rapida/ntl/noaa/cmask.py b/rapida/ntl/noaa/cmask.py
index 9d5f779..10a2604 100644
--- a/rapida/ntl/noaa/cmask.py
+++ b/rapida/ntl/noaa/cmask.py
@@ -312,11 +312,13 @@ def cloud_coverage(hdf_url: str, bbox: list) -> int:
     gdal.PushErrorHandler('CPLQuietErrorHandler')
 
     # --- 1. DYNAMIC DRIVER SELECTION ---
-    is_windows = platform.system() == "Windows"
+    # GDAL's netCDF driver can only read /vsi paths on Linux (it needs userfaultfd).
+    # On Windows and macOS we skip it and drive the HDF5 driver directly instead.
+    use_hdf5_driver = platform.system() != "Linux"
 
-    if is_windows:
+    if use_hdf5_driver:
         gdal.SetConfigOption('GDAL_SKIP', 'netCDF')
-        # On Windows, we force the HDF5 driver and its specific string syntax
+        # On Windows and MacOS, we force the HDF5 driver and its specific string syntax
         base_ds = f'HDF5:"/vsicurl/{hdf_url}"'
         mask_str = f'{base_ds}://CloudMaskBinary'
         lon_str = f'{base_ds}://Longitude'