diff --git a/Yattee/Localizable.xcstrings b/Yattee/Localizable.xcstrings
index d99b6294..a422a23a 100644
--- a/Yattee/Localizable.xcstrings
+++ b/Yattee/Localizable.xcstrings
@@ -12147,6 +12147,28 @@
         }
       }
     },
+    "settings.icloud.unavailable" : {
+      "comment" : "Label shown instead of the iCloud sync toggle when the app installation lacks iCloud entitlements",
+      "localizations" : {
+        "en" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "iCloud Sync Unavailable"
+          }
+        }
+      }
+    },
+    "settings.icloud.unavailable.footer" : {
+      "comment" : "Footer explaining why iCloud sync is unavailable in sideloaded installations",
+      "localizations" : {
+        "en" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "This copy of Yattee was installed without iCloud access, so sync is not available. iCloud sync requires installing the app from the App Store or TestFlight."
+          }
+        }
+      }
+    },
     "settings.icloud.update.message" : {
       "comment" : "Message explaining that newer app version is needed for some synced data",
       "localizations" : {
diff --git a/Yattee/Services/CloudKit/CloudKitAvailability.swift b/Yattee/Services/CloudKit/CloudKitAvailability.swift
new file mode 100644
index 00000000..ceb1e9bc
--- /dev/null
+++ b/Yattee/Services/CloudKit/CloudKitAvailability.swift
@@ -0,0 +1,51 @@
+//
+//  CloudKitAvailability.swift
+//  Yattee
+//
+//  Detects whether the app was signed with the iCloud container entitlement.
+//
+
+import Foundation
+
+/// Sideloaded installs (AltStore, SideStore, Sideloadly, …) are re-signed by a
+/// team that cannot register `iCloud.stream.yattee.app` (container IDs are
+/// globally unique), so the iCloud entitlements are stripped or remapped.
+/// `CKContainer(identifier:)` fatally traps in that state, so the container
+/// must never be created when the entitlement is missing.
+enum CloudKitAvailability {
+    /// Whether CloudKit APIs may be used in this installation.
+    ///
+    /// Determined by parsing the embedded provisioning profile. Builds without
+    /// an embedded profile (App Store, TestFlight, simulator) always carry the
+    /// correct entitlements and are treated as available.
+    static let isAvailable: Bool = {
+        guard let entitlements = embeddedProvisioningEntitlements() else {
+            return true
+        }
+        let containers = entitlements["com.apple.developer.icloud-container-identifiers"] as? [String] ?? []
+        return containers.contains(AppIdentifiers.iCloudContainer)
+    }()
+
+    /// Extracts the entitlements dictionary from the embedded provisioning
+    /// profile — a CMS blob wrapping an XML property list.
+    private static func embeddedProvisioningEntitlements() -> [String: Any]? {
+        #if os(macOS)
+        let url = Bundle.main.bundleURL.appendingPathComponent("Contents/embedded.provisionprofile")
+        #else
+        guard let path = Bundle.main.path(forResource: "embedded", ofType: "mobileprovision") else { return nil }
+        let url = URL(fileURLWithPath: path)
+        #endif
+
+        guard let data = try? Data(contentsOf: url),
+              let start = data.range(of: Data("<?xml".utf8)),
+              let end = data.range(of: Data("</plist>".utf8), in: start.lowerBound..<data.endIndex),
+              let plist = try? PropertyListSerialization.propertyList(
+                  from: data.subdata(in: start.lowerBound..<end.upperBound),
+                  format: nil
+              ),
+              let profile = plist as? [String: Any]
+        else { return nil }
+
+        return profile["Entitlements"] as? [String: Any]
+    }
+}
diff --git a/Yattee/Services/CloudKit/CloudKitSyncEngine.swift b/Yattee/Services/CloudKit/CloudKitSyncEngine.swift
index 3a080808..878ff468 100644
--- a/Yattee/Services/CloudKit/CloudKitSyncEngine.swift
+++ b/Yattee/Services/CloudKit/CloudKitSyncEngine.swift
@@ -64,9 +64,14 @@ final class CloudKitSyncEngine: @unchecked Sendable {
 
     // MARK: - State
 
-    private let container: CKContainer
-    private let database: CKDatabase
-    private let zoneManager: CloudKitZoneManager
+    /// Whether CloudKit is usable in this installation. False when the app was
+    /// re-signed without the iCloud container entitlement (sideloading); all
+    /// sync functionality is disabled then and the CloudKit objects stay nil.
+    let isCloudKitAvailable = CloudKitAvailability.isAvailable
+
+    private let container: CKContainer?
+    private let database: CKDatabase?
+    private let zoneManager: CloudKitZoneManager?
     private var recordMapper: CloudKitRecordMapper
     private var conflictResolver: CloudKitConflictResolver
     private var syncEngine: CKSyncEngine?
@@ -232,12 +237,21 @@ final class CloudKitSyncEngine: @unchecked Sendable {
         self.settingsManager = settingsManager
         self.instancesManager = instancesManager
         
-        // Initialize CloudKit
-        self.container = CKContainer(identifier: AppIdentifiers.iCloudContainer)
-        self.database = container.privateCloudDatabase
-        
-        // Initialize zone manager
-        self.zoneManager = CloudKitZoneManager(database: database)
+        // Initialize CloudKit. CKContainer(identifier:) fatally traps when the
+        // entitlement is missing (re-signed/sideloaded builds), so it must not
+        // be constructed at all in that case.
+        if CloudKitAvailability.isAvailable {
+            let container = CKContainer(identifier: AppIdentifiers.iCloudContainer)
+            let database = container.privateCloudDatabase
+            self.container = container
+            self.database = database
+            self.zoneManager = CloudKitZoneManager(database: database)
+        } else {
+            LoggingService.shared.logCloudKit("iCloud container entitlement missing (re-signed build) - CloudKit sync unavailable")
+            self.container = nil
+            self.database = nil
+            self.zoneManager = nil
+        }
         
         // Initialize with temporary zone (will be updated in setupSyncEngine)
         let tempZone = RecordType.createZone()
@@ -261,6 +275,10 @@ final class CloudKitSyncEngine: @unchecked Sendable {
 
     /// Enables CloudKit sync. Creates CKSyncEngine and starts syncing.
     func enable() async {
+        guard isCloudKitAvailable else {
+            LoggingService.shared.logCloudKit("CloudKit unavailable in this installation, cannot enable sync")
+            return
+        }
         guard syncEngine == nil else {
             LoggingService.shared.logCloudKit("Sync engine already enabled")
             return
@@ -312,6 +330,11 @@ final class CloudKitSyncEngine: @unchecked Sendable {
             return
         }
 
+        guard let container, let database, let zoneManager else {
+            LoggingService.shared.logCloudKit("CloudKit unavailable in this installation, skipping engine setup")
+            return
+        }
+
         do {
             // Check iCloud account status
             let status = try await container.accountStatus()
@@ -387,6 +410,7 @@ final class CloudKitSyncEngine: @unchecked Sendable {
     /// Checks if the iCloud account has changed and handles it by clearing sync state.
     /// - Returns: `true` if account changed and sync state was cleared, `false` otherwise.
     private func checkAndHandleAccountChange() async -> Bool {
+        guard let container else { return false }
         do {
             // Fetch the current user's record ID using async wrapper
             let currentUserRecordID = try await withCheckedThrowingContinuation { (continuation: CheckedContinuation<CKRecord.ID, Error>) in
@@ -1422,6 +1446,8 @@ final class CloudKitSyncEngine: @unchecked Sendable {
 
     /// Clear all sync state and reset. For testing/debugging only.
     func resetSync() async throws {
+        guard let zoneManager else { return }
+
         // Delete zone (and all records)
         try await zoneManager.deleteZone()
 
@@ -1449,6 +1475,7 @@ final class CloudKitSyncEngine: @unchecked Sendable {
     
     /// Refreshes the cached iCloud account status
     func refreshAccountStatus() async {
+        guard let container else { return }
         do {
             accountStatus = try await container.accountStatus()
         } catch {
@@ -1566,7 +1593,7 @@ final class CloudKitSyncEngine: @unchecked Sendable {
         case .zoneNotFound:
             LoggingService.shared.logCloudKit("Zone not found, recreating...")
             Task {
-                try? await zoneManager.createZoneIfNeeded()
+                try? await zoneManager?.createZoneIfNeeded()
                 await sync()
             }
             
@@ -1882,7 +1909,7 @@ extension CloudKitSyncEngine: CKSyncEngineDelegate {
             // Zone was deleted — recreate it and retry the save
             syncEngine?.state.add(pendingRecordZoneChanges: [.saveRecord(recordID)])
             Task {
-                try? await zoneManager.createZoneIfNeeded()
+                try? await zoneManager?.createZoneIfNeeded()
             }
             LoggingService.shared.logCloudKit("Zone missing for \(recordName), recreating and retrying")
 
@@ -1966,7 +1993,7 @@ extension CloudKitSyncEngine: CKSyncEngineDelegate {
         retryCount.removeAll()
 
         do {
-            try await zoneManager.createZoneIfNeeded()
+            try await zoneManager?.createZoneIfNeeded()
             await performInitialUpload()
         } catch {
             LoggingService.shared.logCloudKitError("Failed to recreate zone after remote deletion", error: error)
diff --git a/Yattee/Views/Settings/iCloudSettingsView.swift b/Yattee/Views/Settings/iCloudSettingsView.swift
index 0b6e0bfd..cff5dc85 100644
--- a/Yattee/Views/Settings/iCloudSettingsView.swift
+++ b/Yattee/Views/Settings/iCloudSettingsView.swift
@@ -58,24 +58,31 @@ struct iCloudSettingsView: View {
             }
             #endif
 
-            SettingsFormSection(footer: "settings.icloud.footer") {
-                Toggle(isOn: Binding(
-                    get: { settingsManager?.iCloudSyncEnabled ?? false },
-                    set: { newValue in
-                        if newValue {
-                            showingEnableConfirmation = true
-                        } else {
-                            showingDisableConfirmation = true
-                        }
-                    }
-                )) {
-                    Label(String(localized: "settings.icloud.enable"), systemImage: "icloud")
+            if cloudKitSync?.isCloudKitAvailable == false {
+                SettingsFormSection(footer: "settings.icloud.unavailable.footer") {
+                    Label(String(localized: "settings.icloud.unavailable"), systemImage: "icloud.slash")
+                        .foregroundStyle(.secondary)
+                }
+            } else {
+                SettingsFormSection(footer: "settings.icloud.footer") {
+                    Toggle(isOn: Binding(
+                        get: { settingsManager?.iCloudSyncEnabled ?? false },
+                        set: { newValue in
+                            if newValue {
+                                showingEnableConfirmation = true
+                            } else {
+                                showingDisableConfirmation = true
+                            }
+                        }
+                    )) {
+                        Label(String(localized: "settings.icloud.enable"), systemImage: "icloud")
+                    }
                 }
-            }
 
-            if settingsManager?.iCloudSyncEnabled == true {
-                syncCategoriesSection
-                syncStatusSection
+                if settingsManager?.iCloudSyncEnabled == true {
+                    syncCategoriesSection
+                    syncStatusSection
+                }
             }
         }
         #if !os(tvOS)