diff --git a/pkg/mac/build-functions.sh b/pkg/mac/build-functions.sh
index de94b8ba87d..de0f89318a7 100644
--- a/pkg/mac/build-functions.sh
+++ b/pkg/mac/build-functions.sh
@@ -291,8 +291,29 @@ _complete_bundle() {
     pushd "${SOURCE_DIR}/web" > /dev/null || exit
         yarn set version berry
         yarn set version 4
-        yarn install
-        yarn run bundle
+        yarn install 2>&1
+
+        # Record the source commit hash before the heavy lint/webpack
+        # steps. `yarn run` needs node_modules so this runs after install,
+        # but it's a pure `git log` redirect (see web/package.json
+        # "git:hash") that costs ~nothing, so doing it up front means the
+        # commit_hash file is captured even if webpack later bails out.
+        echo "==> Recording git hash..."
+        yarn run git:hash
+
+        # Split the "bundle" script into its underlying steps and merge
+        # stderr into stdout, so a crash inside lint/webpack (e.g. an OOM
+        # kill or native-module load failure) leaves a trace in the
+        # Jenkins console instead of an empty gap before the trap fires.
+        # Env vars match the top-level "bundle" npm script (see web/package.json)
+        # so behavior is identical to `yarn run bundle`.
+        export NODE_ENV=production
+        export NODE_OPTIONS=--max-old-space-size=3072
+        echo "==> Running ESLint..."
+        yarn run linter 2>&1
+        echo "==> Running webpack bundle..."
+        yarn run webpacker 2>&1
+        unset NODE_ENV NODE_OPTIONS
 
         curl https://curl.se/ca/cacert.pem -o cacert.pem -s
     popd > /dev/null || exit