diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml
index 62ed34ae3..072b1aa36 100644
--- a/.github/workflows/desktop-build.yml
+++ b/.github/workflows/desktop-build.yml
@@ -280,10 +280,10 @@ jobs:
           security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
           security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
           security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
-          /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --verify "./build/cockatrice/cockatrice.app" 
-          /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --verify "./build/oracle/oracle.app"
-          /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --verify "./build/servatrice/servatrice.app"
-          /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --verify "./build/dbconverter/dbconverter.app"
+          /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --verbose "./build/cockatrice/cockatrice.app" 
+          /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --verbose "./build/oracle/oracle.app"
+          /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --verbose "./build/servatrice/servatrice.app"
+          /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --verbose "./build/dbconverter/dbconverter.app"
 
 #      - name: CodeSign app bundle
 #        env:
diff --git a/CMakeLists.txt b/CMakeLists.txt
index e027d5f07..3080c0bbf 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -122,7 +122,14 @@ if(UNIX)
       set(CMAKE_XCODE_ATTRIBUTE_CXX "${CMAKE_BINARY_DIR}/launch-cxx")
       set(CMAKE_XCODE_ATTRIBUTE_LD "${CMAKE_BINARY_DIR}/launch-c")
       set(CMAKE_XCODE_ATTRIBUTE_LDPLUSPLUS "${CMAKE_BINARY_DIR}/launch-cxx")
+
+      # This tells Xcode's signing phase to pretend that the binary was signed by the linker.
+      # Then install_name_tool is willing to revise the ad-hoc signature.
+      # See: https://gitlab.kitware.com/cmake/cmake/-/issues/21854#note_907691
       set(CMAKE_XCODE_ATTRIBUTE_OTHER_CODE_SIGN_FLAGS "-o linker-signed")
+
+      # Stripping the files will invalidate the signatures.
+      set(CPACK_STRIP_FILES FALSE)
     endif()
   else()
     # Linux / BSD