diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 9b55d4c..6b33045 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -135,8 +135,13 @@ jobs:
           security set-key-partition-list -S apple-tool:,apple: -s -k $KEYCHAIN_PASSWORD build.keychain
           
           # build the binary and signin with certificate
-          pyinstaller hf_to_cb_dataset_migrator/cli.py --name hf_to_cb_dataset_migrator --codesign-identity "Developer ID Application: Couchbase, Inc. ($APPLE_TEAM_ID)"
+          pyinstaller hf_to_cb_dataset_migrator/cli.py --name hf_to_cb_dataset_migrator
           
+
+          codesign --force --options runtime --timestamp --entitlements ./entitlements.plist \
+          --sign "Developer ID Application: Couchbase, Inc. ($APPLE_TEAM_ID)" \
+          dist/hf_to_cb_dataset_migrator/hf_to_cb_dataset_migrator
+
           # Verify the code-signing
           codesign --verify --deep --strict --verbose dist/hf_to_cb_dataset_migrator/hf_to_cb_dataset_migrator
 
diff --git a/entitlements.plist b/entitlements.plist
new file mode 100644
index 0000000..2ac1f14
--- /dev/null
+++ b/entitlements.plist
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+        <!-- These are required for binaries built by PyInstaller -->
+        <key>com.apple.security.cs.allow-jit</key>
+        <true/>
+        <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+        <true/>
+        <key>com.apple.security.cs.disable-library-validation</key>
+        <true/>
+</dict>
+</plist>
\ No newline at end of file