@eskimo I've added com.apple.application-identifier and com.apple.developer.team-identifier and it works now, thanks. Oh, and you’re not using --deep, right? Right, I've seen your post. Also, why are you disabling library validation (com.apple.security.cs.disable-library-validation)? I need it to load 3rd party DAL plugins. For other users, the final entitlements: <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>com.apple.developer.system-extension.install</key> <true/> <key>com.apple.security.application-groups</key> <array> <string>7XXXXXXXX.com.example.AppName</string> </array> <key>com.apple.application-identifier</key> <string>7XXXXXXXX.com.example.AppName</string> <key>com.apple.developer.team-identifier</key> <string>7XXXXXXXX</string> </dict> </plist>