diff --git a/orbit/changes/37134-fix-issue-with-end-user-auth-on-macos b/orbit/changes/37134-fix-issue-with-end-user-auth-on-macos
new file mode 100644
index 0000000000..97921ef044
--- /dev/null
+++ b/orbit/changes/37134-fix-issue-with-end-user-auth-on-macos
@@ -0,0 +1 @@
+- Fixed an issue where macOS devices would fail to enroll when end-user authentication was configured.
diff --git a/server/fleet/capabilities.go b/server/fleet/capabilities.go
index 2d345d2595..fe495632ed 100644
--- a/server/fleet/capabilities.go
+++ b/server/fleet/capabilities.go
@@ -2,6 +2,7 @@ package fleet
 
 import (
 	"os"
+	"runtime"
 	"strings"
 	"sync"
 )
@@ -121,11 +122,15 @@ func GetServerDeviceCapabilities() CapabilityMap {
 }
 
 func GetOrbitClientCapabilities() CapabilityMap {
-	return CapabilityMap{
+	capabilities := CapabilityMap{
 		CapabilityEscrowBuddy:     {},
 		CapabilitySetupExperience: {},
-		CapabilityEndUserAuth:     {},
 	}
+	// On non-macOS systems, include end user auth capability.
+	if runtime.GOOS != "darwin" {
+		capabilities[CapabilityEndUserAuth] = struct{}{}
+	}
+	return capabilities
 }
 
 // CapabilitiesHeader is the header name used to communicate the capabilities.
diff --git a/server/service/orbit.go b/server/service/orbit.go
index e86ee3faa9..d7531d32ce 100644
--- a/server/service/orbit.go
+++ b/server/service/orbit.go
@@ -203,7 +203,8 @@ func (svc *Service) EnrollOrbit(ctx context.Context, hostInfo fleet.OrbitHostInf
 			if !ok {
 				level.Error(svc.logger).Log("msg", "!!! ERR_ALLOWING_UNAUTHENTICATED: host is not authenticated, but fleet could not determine whether orbit supports end-user authentication. proceeding with enrollment. !!! ", "host_uuid", hostInfo.HardwareUUID)
 			} else if !mp.Has(fleet.CapabilityEndUserAuth) {
-				level.Error(svc.logger).Log("msg", "!!! ERR_ALLOWING_UNAUTHENTICATED: host is not authenticated, but connected with an orbit version that does not support end user authentication. proceeding with enrollment. !!! ", "host_uuid", hostInfo.HardwareUUID)
+				// Quieting this error until https://github.com/fleetdm/fleet/issues/37134 has a proper fix.
+				level.Debug(svc.logger).Log("msg", "!!! ERR_ALLOWING_UNAUTHENTICATED: host is not authenticated, but connected with an orbit version that does not support end user authentication. proceeding with enrollment. !!! ", "host_uuid", hostInfo.HardwareUUID)
 			} else {
 				// Otherwise report the unauthenticated host and let Orbit handle it (e.g. by prompting the user to authenticate).
 				return "", fleet.NewOrbitIDPAuthRequiredError()