diff --git a/ext/installfiles/mac/postinst.sh b/ext/installfiles/mac/postinst.sh
index 95301a4e9..5a2b65040 100755
--- a/ext/installfiles/mac/postinst.sh
+++ b/ext/installfiles/mac/postinst.sh
@@ -10,15 +10,14 @@ sleep 0.5
 
 cd "/Library/Application Support/ZeroTier/One"
 
-if [ "$OSX_RELEASE" = "10.7" ]; then
-	# OSX 10.7 cannot use the new tap driver since the new way of kext signing
-	# is not backward compatible. Pull the old one for 10.7 users and replace.
-	# We use https to fetch and check hash as an extra added measure.
+if [ "$OSX_RELEASE" = "10.7" -o "$OSX_RELEASE" = "10.8" -o "$OSX_RELEASE" = "10.9" -o "$OSX_RELEASE" = "10.10" -o "$OSX_RELEASE" = "10.11" -o "$OSX_RELEASE" = "10.12" ]; then
 	rm -f tap.kext.10_7.tar.gz
 	curl -s https://download.zerotier.com/tap.kext.10_7.tar.gz >tap.kext.10_7.tar.gz
 	if [ -s tap.kext.10_7.tar.gz -a "`shasum -a 256 tap.kext.10_7.tar.gz | cut -d ' ' -f 1`" = "e133d4832cef571621d3618f417381b44f51a76ed625089fb4e545e65d3ef2a9" ]; then
 		rm -rf tap.kext
 		tar -xzf tap.kext.10_7.tar.gz
+		chown -R 0 tap.kext
+		chgrp -R 0 tap.kext
 	fi
 	rm -f tap.kext.10_7.tar.gz
 fi