diff --git a/release-tool b/release-tool
index 9d9d4fa9..82d4fbc3 100755
--- a/release-tool
+++ b/release-tool
@@ -1147,7 +1147,7 @@ appsign() {
                 fi
 
                 logInfo "Signing app using codesign..."
-                codesign --sign "${key}" --verbose --deep ./app/KeePassXC.app
+                codesign --sign "${key}" --verbose --deep --entitlements ${orig_dir}/share/macosx/keepassxc.entitlements ./app/KeePassXC.app
 
                 if [ 0 -ne $? ]; then
                     cd "${orig_dir}"
diff --git a/share/macosx/keepassxc.entitlements b/share/macosx/keepassxc.entitlements
new file mode 100644
index 00000000..a6370558
--- /dev/null
+++ b/share/macosx/keepassxc.entitlements
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+	<dict>
+		<key>com.apple.application-identifier</key>
+		<string>org.keepassx.keepassxc</string>
+		<key>com.apple.developer.aps-environment</key>
+		<string>production</string>
+		<key>com.apple.security.network.client</key>
+		<true/>
+		<key>com.apple.security.app-sandbox</key>
+		<true/>
+		<key>com.apple.security.print</key>
+		<true/>
+		<key>com.apple.security.app-sandbox</key>
+		<false/>
+		<key>keychain-access-groups</key>
+		<array>
+			<string>org.keepassx.keepassxc</string>
+		</array>
+		<key>com.apple.security.files.user-selected.read-only</key>
+		<false/>
+	</dict>
+</plist>
\ No newline at end of file