diff --git a/it-and-security/fleets/workstations.yml b/it-and-security/fleets/workstations.yml
index b5b8dfb006..5be8896d03 100644
--- a/it-and-security/fleets/workstations.yml
+++ b/it-and-security/fleets/workstations.yml
@@ -107,6 +107,8 @@ controls:
     - path: ../lib/windows/scripts/enable-ms-defender.ps1
     - path: ../lib/windows/scripts/create-admin-user.ps1
     - path: ../lib/linux/scripts/uninstall-fleetd-linux.sh
+    - path: ../lib/macos/scripts/nudge-postinstall.sh
+    - path: ../lib/macos/scripts/load-santa-system-extension.sh
     - path: ../lib/linux/scripts/install-fleet-desktop-required-extension.sh
 policies:
   # macOS policies
@@ -119,6 +121,7 @@ policies:
   # - path: ../lib/macos/policies/1password-installed.yml https://github.com/fleetdm/fleet/pull/44179
   # - path: ../lib/macos/policies/nudge-installed.yml
   - path: ../lib/macos/policies/install-nudge-assets.yml
+  - path: ../lib/macos/policies/santa-endpoint-security-extension-active.yml
   - path: ../lib/macos/policies/patch-fleet-maintained-apps.yml
   - path: ../lib/macos/policies/update-fleet-desktop.yml
   - path: ../lib/macos/policies/battery-health-check.yml
@@ -144,8 +147,9 @@ reports:
 software:
   packages:
     # macOS apps
-    - path: ../lib/macos/software/santa.yml # Santa for macOS
+    - path: ../lib/macos/software/1password.yml # 1Password for macOS
       self_service: true
+      setup_experience: true
       categories:
         - Security
     - path: ../lib/macos/software/fleet-keynote-theme.yml # Fleet Keynote theme for macOS
@@ -300,6 +304,11 @@ software:
       setup_experience: true
       categories:
         - Security
+    - slug: santa/darwin # Santa for macOS
+      self_service: true
+      setup_experience: true
+      categories:
+        - Security
     - slug: claude/darwin # Claude for macOS
       self_service: true
       setup_experience: true
diff --git a/it-and-security/lib/all/labels/macs-with-fleet-maintained-apps-installed.yml b/it-and-security/lib/all/labels/macs-with-fleet-maintained-apps-installed.yml
index 34503d0ba5..194b03184c 100644
--- a/it-and-security/lib/all/labels/macs-with-fleet-maintained-apps-installed.yml
+++ b/it-and-security/lib/all/labels/macs-with-fleet-maintained-apps-installed.yml
@@ -98,6 +98,11 @@
   query: SELECT 1 FROM apps WHERE bundle_identifier = 'com.spotify.client';
   label_membership_type: dynamic
   platform: darwin
+- name: Macs with Santa installed
+  description: macOS hosts with Santa installed
+  query: SELECT 1 FROM apps WHERE bundle_identifier = 'com.northpolesec.santa';
+  label_membership_type: dynamic
+  platform: darwin
 - name: Macs with Rectangle installed
   description: macOS hosts with Rectangle installed
   query: SELECT 1 FROM apps WHERE bundle_identifier = 'com.knollsoft.Rectangle';
diff --git a/it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml b/it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml
index fd921d8efd..6130a764bf 100644
--- a/it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml
+++ b/it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml
@@ -72,6 +72,14 @@
   install_software: false
   labels_include_any:
     - Macs with Okta Verify installed
+- name: macOS - Santa up to date
+  description: The host may have an outdated version of Santa, potentially risking security vulnerabilities or compatibility issues.
+  resolution: "Santa is an app managed by IT and should be kept up to date automatically. If you are failing this policy, click Refetch. If you are still failing after Refetch completes, drop a note in #help-it."
+  type: patch
+  fleet_maintained_app_slug: santa/darwin
+  install_software: true
+  labels_include_any:
+    - Macs with Santa installed
 - name: macOS - Claude up to date
   description: The host may have an outdated version of Claude, potentially risking security vulnerabilities or compatibility issues.
   resolution: "Download the latest version from Self-service or check for updates using Claude's built-in update functionality. You can also delete Claude if you are no longer using it."
diff --git a/it-and-security/lib/macos/policies/santa-endpoint-security-extension-active.yml b/it-and-security/lib/macos/policies/santa-endpoint-security-extension-active.yml
new file mode 100644
index 0000000000..5d47516967
--- /dev/null
+++ b/it-and-security/lib/macos/policies/santa-endpoint-security-extension-active.yml
@@ -0,0 +1,14 @@
+- name: macOS - Santa Endpoint Security extension active
+  platform: darwin
+  description: Santa is installed but its Endpoint Security system extension is missing or not in the activated enabled state.
+  resolution: "Fleet can run the remediation script to request extension activation. If it still fails, please reach out to help-it in Slack."
+  query: >-
+    SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE bundle_identifier = 'com.northpolesec.santa')
+    OR EXISTS (
+      SELECT 1 FROM system_extensions
+      WHERE identifier = 'com.northpolesec.santa.daemon'
+        AND team = 'ZMCG7MLDV9'
+        AND lower(replace(state, ' ', '_')) = 'activated_enabled'
+    )
+  run_script:
+    path: ../scripts/load-santa-system-extension.sh
diff --git a/it-and-security/lib/macos/scripts/load-santa-system-extension.sh b/it-and-security/lib/macos/scripts/load-santa-system-extension.sh
new file mode 100755
index 0000000000..15c183b7ee
--- /dev/null
+++ b/it-and-security/lib/macos/scripts/load-santa-system-extension.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+set -euo pipefail
+
+SANTA_BIN="/Applications/Santa.app/Contents/MacOS/Santa"
+if [[ ! -x "$SANTA_BIN" ]]; then
+  echo "Santa is not installed at /Applications/Santa.app"
+  exit 1
+fi
+
+current_user=$(stat -f '%Su' /dev/console 2>/dev/null || echo root)
+if [[ "$current_user" != "root" && "$current_user" != "loginwindow" ]]; then
+  sudo -u "$current_user" "$SANTA_BIN" --load-system-extension
+else
+  "$SANTA_BIN" --load-system-extension
+fi
diff --git a/it-and-security/lib/macos/software/santa.yml b/it-and-security/lib/macos/software/santa.yml
deleted file mode 100644
index 38e5d36742..0000000000
--- a/it-and-security/lib/macos/software/santa.yml
+++ /dev/null
@@ -1 +0,0 @@
-url: https://github.com/northpolesec/santa/releases/download/2025.11/santa-2025.11.pkg