diff --git a/.github/workflows/fleet-and-orbit.yml b/.github/workflows/fleet-and-orbit.yml
index 92333ddbfe..a414d877f6 100644
--- a/.github/workflows/fleet-and-orbit.yml
+++ b/.github/workflows/fleet-and-orbit.yml
@@ -186,7 +186,6 @@ jobs:
         go run github.com/fleetdm/fleet/v4/orbit/cmd/orbit \
           --debug \
           --dev-mode \
-          --dev-darwin-legacy-targets \
           --disable-updates \
           --root-dir /tmp/orbit \
           --fleet-url ${{ needs.gen.outputs.address }} \
diff --git a/changes/fleetctl-preview-support-custom-tuf b/changes/fleetctl-preview-support-custom-tuf
new file mode 100644
index 0000000000..17658a76e2
--- /dev/null
+++ b/changes/fleetctl-preview-support-custom-tuf
@@ -0,0 +1 @@
+* Support `fleetctl preview` running with custom TUF server.
diff --git a/cmd/fleetctl/package.go b/cmd/fleetctl/package.go
index c3514dc98a..5747b25849 100644
--- a/cmd/fleetctl/package.go
+++ b/cmd/fleetctl/package.go
@@ -16,7 +16,10 @@ import (
 	"github.com/urfave/cli/v2"
 )
 
-var opt packaging.Options
+var (
+	opt               packaging.Options
+	disableOpenFolder bool
+)
 
 func packageCommand() *cli.Command {
 	return &cli.Command{
@@ -136,6 +139,11 @@ func packageCommand() *cli.Command {
 				Value:       15 * time.Minute,
 				Destination: &opt.OrbitUpdateInterval,
 			},
+			&cli.BoolFlag{
+				Name:        "disable-open-folder",
+				Usage:       "Disable opening the folder at the end",
+				Destination: &disableOpenFolder,
+			},
 		},
 		Action: func(c *cli.Context) error {
 			if opt.FleetURL != "" || opt.EnrollSecret != "" {
@@ -191,7 +199,9 @@ To add this device to Fleet, double-click to open your installer.
 
 To add other devices to Fleet, distribute this installer using Chef, Ansible, Jamf, or Puppet. Learn how: https://fleetdm.com/docs/using-fleet/adding-hosts
 `, path)
-			open.Start(filepath.Dir(path))
+			if !disableOpenFolder {
+				open.Start(filepath.Dir(path))
+			}
 			return nil
 		},
 	}
diff --git a/cmd/fleetctl/preview.go b/cmd/fleetctl/preview.go
index be119e9311..9586c99635 100644
--- a/cmd/fleetctl/preview.go
+++ b/cmd/fleetctl/preview.go
@@ -13,7 +13,6 @@ import (
 	"os/exec"
 	"path"
 	"path/filepath"
-	"runtime"
 	"strconv"
 	"strings"
 	"time"
@@ -38,6 +37,8 @@ const (
 	noHostsFlagName         = "no-hosts"
 	orbitChannel            = "orbit-channel"
 	osquerydChannel         = "osqueryd-channel"
+	updateURL               = "update-url"
+	updateRootKeys          = "update-roots"
 )
 
 func previewCommand() *cli.Command {
@@ -85,6 +86,16 @@ Use the stop and reset subcommands to manage the server and dependencies once st
 				Usage: "Use a custom osqueryd channel",
 				Value: "stable",
 			},
+			&cli.StringFlag{
+				Name:  updateURL,
+				Usage: "Use a custom update TUF URL",
+				Value: "",
+			},
+			&cli.StringFlag{
+				Name:  updateRootKeys,
+				Usage: "Use custom update TUF root keys",
+				Value: "",
+			},
 		},
 		Action: func(c *cli.Context) error {
 			if err := checkDocker(); err != nil {
@@ -260,7 +271,7 @@ Use the stop and reset subcommands to manage the server and dependencies once st
 			if !c.Bool(noHostsFlagName) {
 				fmt.Println("Enrolling local host...")
 
-				if err := downloadOrbitAndStart(previewDir, secrets.Secrets[0].Secret, address, c.String(orbitChannel), c.String(osquerydChannel)); err != nil {
+				if err := downloadOrbitAndStart(previewDir, secrets.Secrets[0].Secret, address, c.String(orbitChannel), c.String(osquerydChannel), c.String(updateURL), c.String(updateRootKeys)); err != nil {
 					return fmt.Errorf("downloading orbit and osqueryd: %w", err)
 				}
 
@@ -574,6 +585,13 @@ func previewResetCommand() *cli.Command {
 				return fmt.Errorf("Failed to stop orbit: %w", err)
 			}
 
+			if err := os.RemoveAll(filepath.Join(previewDir, "tuf-metadata.json")); err != nil {
+				return fmt.Errorf("failed to remove preview update metadata file: %w", err)
+			}
+			if err := os.RemoveAll(filepath.Join(previewDir, "bin")); err != nil {
+				return fmt.Errorf("failed to remove preview bin directory: %w", err)
+			}
+
 			fmt.Println("Fleet preview server and dependencies reset. Start again with fleetctl preview.")
 
 			return nil
@@ -614,7 +632,7 @@ func processNameMatches(pid int, expectedPrefix string) (bool, error) {
 	return strings.HasPrefix(strings.ToLower(process.Executable()), strings.ToLower(expectedPrefix)), nil
 }
 
-func downloadOrbitAndStart(destDir, enrollSecret, address, orbitChannel, osquerydChannel string) error {
+func downloadOrbitAndStart(destDir, enrollSecret, address, orbitChannel, osquerydChannel, updateURL, updateRoots string) error {
 	// Stop any current intance of orbit running, otherwise the configured enroll secret
 	// won't match the generated in the preview run.
 	if err := stopOrbit(destDir); err != nil {
@@ -635,18 +653,19 @@ func downloadOrbitAndStart(destDir, enrollSecret, address, orbitChannel, osquery
 
 	updateOpt := update.DefaultOptions
 
-	if runtime.GOOS == "darwin" {
-		// We need to initialize updates for latest orbit which does not
-		// support .app bundle yet.
-		updateOpt.Targets = update.DarwinLegacyTargets
-	}
-
 	// Override default channels with the provided values.
 	updateOpt.Targets.SetTargetChannel("orbit", orbitChannel)
 	updateOpt.Targets.SetTargetChannel("osqueryd", osquerydChannel)
 
 	updateOpt.RootDirectory = destDir
 
+	if updateURL != "" {
+		updateOpt.ServerURL = updateURL
+	}
+	if updateRoots != "" {
+		updateOpt.RootKeys = updateRoots
+	}
+
 	if _, err := packaging.InitializeUpdates(updateOpt); err != nil {
 		return fmt.Errorf("initialize updates: %w", err)
 	}
diff --git a/orbit/changes/orbit-legacy-targets b/orbit/changes/orbit-legacy-targets
new file mode 100644
index 0000000000..daf08aa950
--- /dev/null
+++ b/orbit/changes/orbit-legacy-targets
@@ -0,0 +1 @@
+* Remove support for Orbit to use the legacy osqueryd target on macOS.
diff --git a/orbit/cmd/orbit/orbit.go b/orbit/cmd/orbit/orbit.go
index 26f28a36c0..1d57a5c66a 100644
--- a/orbit/cmd/orbit/orbit.go
+++ b/orbit/cmd/orbit/orbit.go
@@ -134,10 +134,6 @@ func main() {
 			Name:  "log-file",
 			Usage: "Log to this file path in addition to stderr",
 		},
-		&cli.BoolFlag{
-			Name:  "dev-darwin-legacy-targets",
-			Usage: "Use darwin legacy target (flag only used on darwin)",
-		},
 		&cli.BoolFlag{
 			Name:    "fleet-desktop",
 			Usage:   "Launch Fleet Desktop application (flag currently only used on darwin)",
@@ -218,10 +214,6 @@ func main() {
 
 		opt := update.DefaultOptions
 
-		if runtime.GOOS == "darwin" && c.Bool("dev-darwin-legacy-targets") {
-			opt.Targets = update.DarwinLegacyTargets
-		}
-
 		if c.Bool("fleet-desktop") {
 			switch runtime.GOOS {
 			case "darwin":
diff --git a/orbit/pkg/update/options.go b/orbit/pkg/update/options.go
index 9d7334fce9..4d716ed367 100644
--- a/orbit/pkg/update/options.go
+++ b/orbit/pkg/update/options.go
@@ -21,19 +21,6 @@ var (
 		},
 	}
 
-	DarwinLegacyTargets = Targets{
-		"orbit": TargetInfo{
-			Platform:   "macos",
-			Channel:    "stable",
-			TargetFile: "orbit",
-		},
-		"osqueryd": TargetInfo{
-			Platform:   "macos",
-			Channel:    "stable",
-			TargetFile: "osqueryd",
-		},
-	}
-
 	LinuxTargets = Targets{
 		"orbit": TargetInfo{
 			Platform:   "linux",
diff --git a/tools/tuf/init_tuf.sh b/tools/tuf/init_tuf.sh
index 41f52419be..75e412d1c9 100755
--- a/tools/tuf/init_tuf.sh
+++ b/tools/tuf/init_tuf.sh
@@ -140,6 +140,7 @@ if [ -n "$GENERATE_PKGS" ]; then
     --debug \
     --update-roots="$root_keys" \
     --update-interval=10s \
+    --disable-open-folder \
     --update-url=http://$PKG_HOSTNAME:8081
 
   echo "Generating deb..."
@@ -151,6 +152,7 @@ if [ -n "$GENERATE_PKGS" ]; then
     --debug \
     --update-roots="$root_keys" \
     --update-interval=10s \
+    --disable-open-folder \
     --update-url=http://$DEB_HOSTNAME:8081
 
   echo "Generating rpm..."
@@ -162,6 +164,7 @@ if [ -n "$GENERATE_PKGS" ]; then
     --debug \
     --update-roots="$root_keys" \
     --update-interval=10s \
+    --disable-open-folder \
     --update-url=http://$RPM_HOSTNAME:8081
 
   echo "Generating msi..."
@@ -174,6 +177,7 @@ if [ -n "$GENERATE_PKGS" ]; then
     --debug \
     --update-roots="$root_keys" \
     --update-interval=10s \
+    --disable-open-folder \
     --update-url=http://$MSI_HOSTNAME:8081
 
   echo "Packages generated"