diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7eb8963..980b70c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -24,6 +24,15 @@ jobs:
           ONLY_ACTIVE_ARCH=NO
           CODE_SIGNING_ALLOWED=NO
           build
+      - name: Sign test build
+        run: |
+          app_path="$RUNNER_TEMP/DerivedData/Build/Products/Release/Meetingnotes.app"
+          codesign --force --deep --sign - \
+            --entitlements meetingnotes/meetingnotes.entitlements \
+            "$app_path"
+          codesign --verify --deep --strict "$app_path"
+          codesign -d --entitlements :- "$app_path" 2>&1 \
+            | grep -q 'com.apple.security.network.server'
       - name: Smoke test local API
         run: |
           defaults write owen.meetingnotes muteDeckAPIEnabled -bool true
@@ -44,7 +53,6 @@ jobs:
       - name: Package test build
         run: |
           app_path="$RUNNER_TEMP/DerivedData/Build/Products/Release/Meetingnotes.app"
-          codesign --force --deep --sign - "$app_path"
           ditto -c -k --sequesterRsrc --keepParent \
             "$app_path" "$RUNNER_TEMP/Meetingnotes-macOS.zip"
       - name: Upload test build
diff --git a/meetingnotes/meetingnotes.entitlements b/meetingnotes/meetingnotes.entitlements
index fd6dcba..42da2af 100644
--- a/meetingnotes/meetingnotes.entitlements
+++ b/meetingnotes/meetingnotes.entitlements
@@ -16,6 +16,8 @@
 	<true/>
 	<key>com.apple.security.network.client</key>
 	<true/>
+	<key>com.apple.security.network.server</key>
+	<true/>
 	<key>com.apple.security.temporary-exception.mach-lookup.global-name</key>
 	<array>
 		<string>owen.meetingnotes-spks</string>