diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 676b1c0689..c42986fd10 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -159,6 +159,15 @@ jobs:
           ./scripts/github-ci.sh qt-osx;
         env:
           OS_NAME: osx
+      - name: Ad-hoc sign BitBox.app
+        run: |
+          APP_PATH="$HOME/go/src/github.com/BitBoxSwiss/bitbox-wallet-app/frontends/qt/build/osx/BitBox.app"
+          echo "Signing app at $APP_PATH"
+          codesign --deep --force --verbose --sign - "$APP_PATH"
+      - name: Verify app signature
+        run: |
+          APP_PATH="$HOME/go/src/github.com/BitBoxSwiss/bitbox-wallet-app/frontends/qt/build/osx/BitBox.app"
+          codesign --verify --deep --strict --verbose=2 "$APP_PATH"
       - name: Archive app
         run: >
           pushd ~/go/src/github.com/BitBoxSwiss/bitbox-wallet-app/frontends/qt/build/osx;