diff --git a/ext/installfiles/mac/postinst.sh b/ext/installfiles/mac/postinst.sh
index 47d9ddd96..da15f9c84 100755
--- a/ext/installfiles/mac/postinst.sh
+++ b/ext/installfiles/mac/postinst.sh
@@ -2,9 +2,26 @@
 
 export PATH=/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin
 
+OSX_RELEASE=`sw_vers -productVersion | cut -d . -f 1,2`
+
 launchctl unload /Library/LaunchDaemons/com.zerotier.one.plist >>/dev/null 2>&1
+sleep 1
 
 cd "/Library/Application Support/ZeroTier/One"
+
+if [ "$OSX_RELEASE" = "10.7" ]; then
+	# OSX 10.7 cannot use the new tap driver since the new way of kext signing
+	# is not backward compatible. Pull the old one for 10.7 users and replace.
+	# We use https to fetch and check hash as an extra added measure.
+	rm -f tap.kext.10_7.tar.gz
+	curl -s https://download.zerotier.com/tap.kext.10_7.tar.gz >tap.kext.10_7.tar.gz
+	if [ -s tap.kext.10_7.tar.gz -a "`shasum -a 256 tap.kext.10_7.tar.gz | cut -d ' ' -f 1`" = "e133d4832cef571621d3618f417381b44f51a76ed625089fb4e545e65d3ef2a9" ]; then
+		rm -rf tap.kext
+		tar -xzf tap.kext.10_7.tar.gz
+	fi
+	rm -f tap.kext.10_7.tar.gz
+fi
+
 rm -rf node.log node.log.old root-topology shutdownIfUnreadable autoupdate.log updates.d
 chown -R 0 tap.kext
 chgrp -R 0 tap.kext