diff --git a/build.xml b/build.xml
index a82ffd21..a16f3dac 100644
--- a/build.xml
+++ b/build.xml
@@ -305,6 +305,25 @@
 			<argument value="--log-file" />
 			<argument value="filebot.log" />
 		</bundleapp>
+
+
+		<!-- fix permissions -->
+		<chmod verbose="true" dir="${dir.dist}" includes="**/fpcalc" perm="755" />
+
+		<!-- sign cmdline tool first -->
+		<exec dir="${dir.dist}" executable="codesign">
+			<arg line="--verbose=4 --sign '-' --entitlements '${dir.installer}/appbundle/fpcalc.entitlements' --prefix net.filebot.tools -i org.acoustid.fpcalc FileBot.app/Contents/MacOS/fpcalc" />
+		</exec>
+
+		<!-- sign app with entitlements -->
+		<exec dir="${dir.dist}" executable="codesign">
+			<arg line="--verbose=4 --deep --sign '-' --entitlements '${dir.installer}/appbundle/FileBot.entitlements' FileBot.app" />
+		</exec>
+
+		<!-- verify signature -->
+		<exec dir="${dir.dist}" executable="codesign" failonerror="on">
+			<arg line=" --verbose=4 --verify --deep FileBot.app" />
+		</exec>
 	</target>
 
 
diff --git a/installer/appbundle/FileBot.entitlements b/installer/appbundle/FileBot.entitlements
new file mode 100644
index 00000000..674041d7
--- /dev/null
+++ b/installer/appbundle/FileBot.entitlements
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.security.app-sandbox</key>
+	<true/>
+	<key>com.apple.security.files.bookmarks.app-scope</key>
+	<true/>
+	<key>com.apple.security.files.user-selected.read-write</key>
+	<true/>
+	<key>com.apple.security.files.downloads.read-write</key>
+	<true/>
+	<key>com.apple.security.assets.movies.read-write</key>
+	<true/>
+	<key>com.apple.security.assets.music.read-write</key>
+	<true/>
+	<key>com.apple.security.network.client</key>
+	<true/>
+</dict>
+</plist>
diff --git a/installer/appbundle/JavaApplicationStub b/installer/appbundle/JavaApplicationStub
deleted file mode 100644
index 7035592f..00000000
Binary files a/installer/appbundle/JavaApplicationStub and /dev/null differ
diff --git a/installer/appbundle/fpcalc.entitlements b/installer/appbundle/fpcalc.entitlements
new file mode 100644
index 00000000..794eada1
--- /dev/null
+++ b/installer/appbundle/fpcalc.entitlements
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.security.app-sandbox</key>
+	<true/>
+	<key>com.apple.security.inherit</key>
+	<true/>
+</dict>
+</plist>