diff --git a/docker/Dockerfile b/docker/Dockerfile
index d0a6388abc..8db37e4383 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -42,7 +42,15 @@ ENV PATH="/usr/lib/ccache:$PATH"
 # if your host user has a different UID/GID.
 ARG USER_UID=1000
 ARG USER_GID=1000
-RUN groupadd -g "${USER_GID}" builder \
+# groupadd fails outright if USER_GID is already taken by an existing
+# system group - which happens whenever a host's primary GID collides with
+# one baked into the rockylinux9 base image. The main real-world case is
+# macOS, where the default user's primary group is "staff" at GID 20, and
+# GID 20 is "games" on RHEL-family images. Only create the "builder" group
+# when that GID is actually free; otherwise useradd just attaches to
+# whichever group already owns it. Either way the builder user ends up
+# with the right GID for bind-mount ownership, which is all that matters.
+RUN (getent group "${USER_GID}" >/dev/null || groupadd -g "${USER_GID}" builder) \
     && useradd -m -u "${USER_UID}" -g "${USER_GID}" -s /bin/bash builder \
     && echo "builder ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/builder
 
diff --git a/docker/ifcos_env b/docker/ifcos_env
index 4286421572..72263065b5 100755
--- a/docker/ifcos_env
+++ b/docker/ifcos_env
@@ -112,7 +112,16 @@ function unique() {
         echo -e "\nUNIQUE_ID=dummy\n" >> "$ENV_FILE"
     fi
 
-    export UNIQUE_ID="$(pwd | sha256sum | cut -c -8)" && sed -si "s/^UNIQUE_ID=.*$/UNIQUE_ID=${UNIQUE_ID}/" "$ENV_FILE"
+    export UNIQUE_ID="$(pwd | sha256sum | cut -c -8)"
+
+    # `sed -i` takes incompatible syntax between GNU sed (Linux) and BSD sed
+    # (macOS) - `-si` is GNU-only and errors as "illegal option -- s" under
+    # BSD/macOS sed. Avoid -i altogether and do the in-place edit via a temp
+    # file + mv instead, which behaves identically with either sed.
+    local tmp_file
+    tmp_file="$(mktemp "${ENV_FILE}.XXXXXX")"
+    sed "s/^UNIQUE_ID=.*$/UNIQUE_ID=${UNIQUE_ID}/" "$ENV_FILE" > "$tmp_file"
+    mv "$tmp_file" "$ENV_FILE"
 
     set_env
 }