diff --git a/build/mac/afterBuildHook.cjs b/build/mac/afterBuildHook.cjs
new file mode 100644
index 00000000..a306e784
--- /dev/null
+++ b/build/mac/afterBuildHook.cjs
@@ -0,0 +1,16 @@
+const fs = require('fs')
+const signHook = require('./afterSignHook.cjs')
+
+module.exports = async function (params) {
+    // notarize the app on Mac OS only.
+    if (process.platform !== 'darwin' || !process.env.GITHUB_REF || !process.env.GITHUB_REF.startsWith('refs/tags/')) {
+        return
+    }
+    console.log('afterBuild hook triggered')
+
+    let pkgName = fs.readdirSync('dist').find(x => x.endsWith('.pkg'))
+    signHook({
+        appOutDir: 'dist',
+        _pathOverride: pkgName,
+    })
+}
diff --git a/build/mac/afterSignHook.cjs b/build/mac/afterSignHook.cjs
new file mode 100644
index 00000000..bad98de0
--- /dev/null
+++ b/build/mac/afterSignHook.cjs
@@ -0,0 +1,35 @@
+// See: https://medium.com/@TwitterArchiveEraser/notarize-electron-apps-7a5f988406db
+
+const fs = require('fs')
+const path = require('path')
+const notarizer = require('electron-notarize')
+
+module.exports = async function (params) {
+    // notarize the app on Mac OS only.
+    if (process.platform !== 'darwin' || !process.env.GITHUB_REF || !process.env.GITHUB_REF.startsWith('refs/tags/')) {
+        return
+    }
+    console.log('afterSign hook triggered', params)
+
+    let appId = 'org.tabby'
+
+    let appPath = path.join(params.appOutDir, params._pathOverride || `${params.packager.appInfo.productFilename}.app`)
+    if (!fs.existsSync(appPath)) {
+        throw new Error(`Cannot find application at: ${appPath}`)
+    }
+
+    console.log(`Notarizing ${appId} found at ${appPath}`)
+
+    try {
+        await notarizer.notarize({
+            appBundleId: appId,
+            appPath: appPath,
+            appleId: process.env.APPSTORE_USERNAME,
+            appleIdPassword: process.env.APPSTORE_PASSWORD,
+        })
+    } catch (error) {
+        console.error(error)
+    }
+
+    console.log(`Done notarizing ${appId}`)
+}