The profiles tool no longer supports installs on this macOS; rake
profile:install now opens the rendered file so approval happens in
System Settings → Profiles. Removal keeps the CLI path with the GUI
fallback documented.

Assisted-by: GLM 5.2 via pi

diff --git a/Rakefile b/Rakefile
index 174376e..4154d3f 100644
--- a/Rakefile
+++ b/Rakefile
@@ -33,12 +33,12 @@ file "carddav.mobileconfig" => "lib/pro_tacts/profile.rb" do |task|
 end
 
 namespace :profile do
-  desc "Install the configuration profile (sudo)"
+  desc "Stage the configuration profile for install; approve it in System Settings → Profiles"
   task install: "carddav.mobileconfig" do |task|
-    sh "sudo", "profiles", "install", "-type", "configuration", "-path", task.prerequisites.first
+    sh "open", task.prerequisites.first
   end
 
-  desc "Remove the configuration profile (sudo)"
+  desc "Remove the configuration profile (sudo); if the CLI refuses, remove it in System Settings → Profiles"
   task :remove do
     require "pro_tacts/profile"
     sh "sudo", "profiles", "remove", "-identifier", ProTacts::Profile::PAYLOAD_IDENTIFIER
diff --git a/docs/macos-contacts.md b/docs/macos-contacts.md
index 14eee33..ebc8235 100644
--- a/docs/macos-contacts.md
+++ b/docs/macos-contacts.md
@@ -27,17 +27,20 @@ refusing a redirect) that never reach the server at all.
 ## The account setup path
 
 The fastest path is a configuration profile: `rake profile:install` (with
-`PRO_TACTS_HOSTNAME` set) renders `carddav.mobileconfig` and installs it;
-`rake profile:remove` removes it. Both shell out to sudo.
+`PRO_TACTS_HOSTNAME` set) renders `carddav.mobileconfig` and opens it —
+the profiles CLI no longer supports installs, so the profile lands in
+System Settings → Profiles as pending until you click Install. That click
+is the whole manual step. `rake profile:remove` still tries
+`sudo profiles remove`; if the CLI refuses that too, remove it in the same
+Settings pane.
 
 The profile carries the hostname, fixed dev credentials, and SSL —
 `CardDAVPrincipalURL` is deliberately omitted so the
 account gets an empty Server Path, exercising discovery. Fixed payload
 identifiers mean a reinstall replaces the account in place, and removal is
-what resets the client's cached discovery results. Recent macOS may stage
-the profile as pending until you approve it once in System Settings →
-Profiles. Apple's device-management reference marks the CardDAV payload as
-allowing manual install, so no MDM is involved.
+what resets the client's cached discovery results. Apple's device-management
+reference marks the CardDAV payload as allowing manual install, so no MDM is
+involved.
 
 The manual alternative, for cross-checking when the profile path misbehaves:
 In System Settings, add the account under Internet Accounts, Add Other