What changes on your MacBook

• SIP is turned off. You start the MacBook in Recovery and run csrutil disable in Terminal. On a Mac with Apple silicon this also lowers the startup disk’s security policy to Permissive Security, where macOS no longer enforces kernel extension signatures (Apple Platform Security).
• A kernel extension is installed and loaded. It is RigValet’s USB driver, and it runs with the kernel’s privileges. It is signed by Apple Developer ID team 2QBT4HF69Q, and macOS won’t load it until you click Allow for that team in System Settings, under Privacy & Security.
• A helper runs as root. One administrator prompt installs it. It does the steps that need root, like starting the driver on a USB-C port.
• Internet sharing, while the cable is in. RigValet may share the MacBook’s internet connection with the Mac mini over the cable.
• Three restarts. Into Recovery, back out of it, and once more after you allow the driver.

SIP stays off, and the driver and helper stay installed, until you undo them (below). Turning SIP back on stops the driver loading, so RigValet stops working and using it again means another trip to Recovery. It doesn’t remove the helper or the driver; that’s a separate step. Turning SIP off lowers your MacBook’s security for as long as it’s off. Back up first. See our terms.

What you give up, and what stays on

With SIP off, expect to lose these on the MacBook. We haven’t measured them ourselves:

• iPhone and iPad apps from the App Store. They stop opening. Developers and vendors have reported this since 2020; we haven’t tested it on macOS 27. Mac apps, including Catalyst ones, aren’t reported affected.
• Apple Pay. Reported off under Permissive Security, which is what SIP off means on Apple silicon. An Apple engineer’s Apple Pay checklist on the developer forums asks for SIP to be enabled.
• A work Mac’s compliance. Microsoft Intune can require SIP on. If your company’s policy does, the MacBook is marked non-compliant and can lose access to work resources. Don’t use a work-managed MacBook.

On our own MacBook, with SIP off (M1 Max, macOS 27.0), we checked what stays on: FileVault is on, Gatekeeper still checks apps, XProtect’s malware definitions still update, the sealed system volume is intact, and Touch ID is still set up for unlocking. We also saw apps read files that Full Disk Access normally guards, without permission; we think SIP being off is why. That’s one developer’s Mac, not a promise for yours.

What changes on the Mac mini

No RigValet driver or agent is installed on the mini, no RigValet app stays there, and its SIP is left as it is. RigValet types into it like a person at a keyboard. Here is everything it changes:

• The account. It creates the administrator account Setup Assistant asks for.
• Screen Sharing and Remote Login. It turns both on.
• RigValet’s SSH key. It adds the key of the RigValet app on your MacBook to the new account’s ~/.ssh/authorized_keys, so the MacBook can log in to the mini without typing. To remove it, delete that line from the file.
• Sleep is turned off. It sets the mini never to sleep, with Power Nap off, so it doesn’t nap halfway through. To undo it, run sudo pmset restoredefaults on the mini.
• A Setup Complete screen. When setup finishes, a small RigValet app shows Setup Complete on the mini, then removes itself.
• Erase, only if you ask. It can erase the mini and start Setup Assistant again.

It doesn’t join Wi-Fi. Setup Assistant runs offline, so RigValet never asks for your Wi-Fi password.

Turn SIP back on

When you’re done with RigValet, remove it first, then turn SIP back on. Step 1 removes the helper and the driver; the rest are the SIP steps, which RigValet’s app also shows.

1. While SIP is still off, remove RigValet. Quit it, then in Terminal run /Applications/RigValet.app/Contents/MacOS/rigvalet reset --yes and enter your password. It removes the root helper, unloads and removes the driver and its approval, and resets RigValet’s privacy permissions. Run it without --yes first to see the plan. With SIP on, it can’t clear the driver’s approval.
2. Shut down the MacBook. Press and hold the power button until Loading startup options appears.
3. Click Options, then Continue, and sign in as an administrator.
4. Choose Utilities › Terminal. Type csrutil enable, press Return, and confirm with y and your password.
5. Choose Utilities › Startup Security Utility, pick your disk, and choose Full Security. This undoes the security policy change.
6. Restart. In Terminal, csrutil status now says SIP is enabled.

Apple’s own steps: Disabling and enabling System Integrity Protection and starting up from macOS Recovery.