diff --git a/.github/workflows/build-docker-images.yml b/.github/workflows/build-docker-images.yml
index a5c8db5..d6eaf2a 100644
--- a/.github/workflows/build-docker-images.yml
+++ b/.github/workflows/build-docker-images.yml
@@ -37,7 +37,7 @@ jobs:
           run-build: true
 
       - name: Sign and notarize the release build
-        uses: toitlang/action-macos-sign-notarize@v1.0.0
+        uses: toitlang/action-macos-sign-notarize@v1.1.0
         with:
           certificate: ${{ secrets.APPLE_CERTIFICATE }}
           certificate-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -45,6 +45,7 @@ jobs:
           password: ${{ secrets.APPLE_ID_PASSWORD }}
           apple-team-id: ${{ secrets.APPLE_TEAM_ID }}
           app-path: build/flight_sql
+          entitlements-path: macos/entitlements.plist
 
       - name: Zip artifacts
         run: |
@@ -52,7 +53,6 @@ jobs:
           zip -j ${{ env.zip_file_name }} flight_sql
 
       - name: Upload artifacts
-        id: artifact-upload-step
         uses: actions/upload-artifact@v4
         with:
           name: ${{ env.zip_file_name }}
@@ -102,7 +102,6 @@ jobs:
           zip -j ${{ env.zip_file_name }} flight_sql
 
       - name: Upload artifacts
-        id: artifact-upload-step
         uses: actions/upload-artifact@v4
         with:
           name: ${{ env.zip_file_name }}
@@ -129,8 +128,8 @@ jobs:
           provenance: false
 
   create-release:
-    if: startsWith(github.ref, 'refs/tags/')
     name: Create a release
+    if: startsWith(github.ref, 'refs/tags/')
     needs: [build-project-macos, build-project-linux]
     runs-on: ubuntu-latest
     steps:
diff --git a/macos/entitlements.plist b/macos/entitlements.plist
new file mode 100644
index 0000000..53d5c7b
--- /dev/null
+++ b/macos/entitlements.plist
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <!-- We are disabling library validation b/c DuckDB imports extension libraries that are not signed by our Apple Team ID -->
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+</dict>
+</plist>
\ No newline at end of file