diff --git a/Services/UTMAppleVirtualMachine.swift b/Services/UTMAppleVirtualMachine.swift
index 0646705a..4ffb0086 100644
--- a/Services/UTMAppleVirtualMachine.swift
+++ b/Services/UTMAppleVirtualMachine.swift
@@ -753,18 +753,14 @@ extension UTMAppleVirtualMachine {
         registryEntry.sharedDirectories.removeAll(keepingCapacity: true)
         for sharedDirectory in configShares {
             if let url = sharedDirectory.directoryURL {
-                _ = url.startAccessingSecurityScopedResource()
                 let file = try UTMRegistryEntry.File(url: url, isReadOnly: sharedDirectory.isReadOnly)
                 registryEntry.sharedDirectories.append(file)
-                url.stopAccessingSecurityScopedResource()
             }
         }
         for drive in configDrives {
             if drive.isExternal, let url = drive.imageURL {
-                _ = url.startAccessingSecurityScopedResource()
                 let file = try UTMRegistryEntry.File(url: url, isReadOnly: drive.isReadOnly)
                 registryEntry.externalDrives[drive.id] = file
-                url.stopAccessingSecurityScopedResource()
             }
         }
         // remove any unreferenced drives
@@ -773,9 +769,7 @@ extension UTMAppleVirtualMachine {
         })
         // save IPSW reference
         if let url = config.system.boot.macRecoveryIpswURL {
-            _ = url.startAccessingSecurityScopedResource()
             registryEntry.macRecoveryIpsw = try UTMRegistryEntry.File(url: url, isReadOnly: true)
-            url.stopAccessingSecurityScopedResource()
         } else {
             registryEntry.macRecoveryIpsw = nil
         }
diff --git a/Services/UTMExtensions.swift b/Services/UTMExtensions.swift
index 38ca559f..9d1ef8b4 100644
--- a/Services/UTMExtensions.swift
+++ b/Services/UTMExtensions.swift
@@ -353,6 +353,12 @@ extension URL {
             options.insert(.securityScopeAllowOnlyReadAccess)
         }
         #endif
+        let scopedAccess = startAccessingSecurityScopedResource()
+        defer {
+            if scopedAccess {
+                stopAccessingSecurityScopedResource()
+            }
+        }
         return try self.bookmarkData(options: options,
                                      includingResourceValuesForKeys: nil,
                                      relativeTo: nil)