diff --git a/cmake/MacApp.cmake b/cmake/MacApp.cmake
index a94f96c34..e2959f84e 100644
--- a/cmake/MacApp.cmake
+++ b/cmake/MacApp.cmake
@@ -58,11 +58,18 @@ ADD_CUSTOM_COMMAND(TARGET fish_macapp POST_BUILD
     VERBATIM
 )
 
+# The entitlements file.
+SET(MACAPP_ENTITLEMENTS "${CMAKE_SOURCE_DIR}/osx/MacApp.entitlements")
+
 # Target to sign the macapp.
 # Note that a POST_BUILD step happens before resources are copied,
 # and therefore would be too early.
 ADD_CUSTOM_TARGET(signed_fish_macapp
-    DEPENDS fish_macapp
-    COMMAND codesign --force --deep --options runtime --sign "${MAC_CODESIGN_ID}" $<TARGET_BUNDLE_DIR:fish_macapp>
+    DEPENDS fish_macapp "${MACAPP_ENTITLEMENTS}"
+    COMMAND codesign --force --deep
+            --options runtime
+            --entitlements "${MACAPP_ENTITLEMENTS}"
+            --sign "${MAC_CODESIGN_ID}"
+            $<TARGET_BUNDLE_DIR:fish_macapp>
     VERBATIM
 )
diff --git a/osx/MacApp.entitlements b/osx/MacApp.entitlements
new file mode 100644
index 000000000..49ad0bb09
--- /dev/null
+++ b/osx/MacApp.entitlements
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.security.automation.apple-events</key>
+	<true/>
+</dict>
+</plist>