diff --git a/Xcode/Extension/LP700.entitlements b/Xcode/Extension/LP700.entitlements
new file mode 100644
index 0000000..eb0df68
--- /dev/null
+++ b/Xcode/Extension/LP700.entitlements
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<!-- ExtensionKit extensions must be sandboxed for macOS to register and load them. -->
+	<key>com.apple.security.app-sandbox</key>
+	<true/>
+	<!-- LP-700 connects out to the LP-700 WebSocket server on the LAN. -->
+	<key>com.apple.security.network.client</key>
+	<true/>
+</dict>
+</plist>
diff --git a/Xcode/project.yml b/Xcode/project.yml
index 68056ba..c9e1ebb 100644
--- a/Xcode/project.yml
+++ b/Xcode/project.yml
@@ -44,6 +44,8 @@ targets:
         MARKETING_VERSION: "1.0.0"
         CODE_SIGN_STYLE: Manual
         CODE_SIGN_IDENTITY: "-"      # ad-hoc for local dev; Developer-ID needed to ship
+        ENABLE_HARDENED_RUNTIME: YES                          # required for notarization
+        CODE_SIGN_ENTITLEMENTS: Extension/LP700.entitlements  # app-sandbox + network.client -> macOS registers it
     dependencies:
       - package: RadioPluginKit
         product: RadioPluginKit