diff --git a/SDL/macbundle.sh b/SDL/macbundle.sh
index 29de754e70..d54a0517ae 100755
--- a/SDL/macbundle.sh
+++ b/SDL/macbundle.sh
@@ -38,7 +38,7 @@ elif [ "$(otool -L "${PPSSPPSDL}" | grep @rpath/SDL)" != "" ]; then
 fi
 
 GIT_VERSION_LINE=$(grep "PPSSPP_GIT_VERSION = " "$(dirname "${0}")/../git-version.cpp")
-echo "Setting version to ${GIT_VERSION_LINE}..."
+echo "Setting version to '${GIT_VERSION_LINE}'..."
 SHORT_VERSION_MATCH='.*"v([0-9\.]+(-[0-9]+)?).*";'
 LONG_VERSION_MATCH='.*"v(.*)";'
 if [[ "${GIT_VERSION_LINE}" =~ ^${SHORT_VERSION_MATCH}$ ]]; then
diff --git a/macOS/Entitlements.plist b/macOS/Entitlements.plist
new file mode 100644
index 0000000000..68fea254f3
--- /dev/null
+++ b/macOS/Entitlements.plist
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-executable-page-protection</key>
+    <true/>
+</dict>
+</plist>
diff --git a/macOS/README.md b/macOS/README.md
new file mode 100644
index 0000000000..3ca4fa3df0
--- /dev/null
+++ b/macOS/README.md
@@ -0,0 +1,3 @@
+Entitlements.plist is to be used for code signing on macOS.
+
+We enable "hardened runtime" in order to make notarization happy, but we need some exceptions.