diff --git a/Makefile b/Makefile
index 7525a73..338f781 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: build test lint check clean install
+.PHONY: build test lint check clean install release-mac
 
 BUILD_DATE := $(shell date -u +"%Y-%m-%dT%H:%M:%SZ")
 GIT_HEIGHT := $(shell git rev-list --count HEAD 2>/dev/null || echo 0)
@@ -35,3 +35,16 @@ install:
 
 clean:
 	rm -rf .build/
+
+# First Developer ID Application identity in the keychain; override when there
+# is more than one: make release-mac SIGN_IDENTITY="Developer ID Application: Name (TEAMID)"
+SIGN_IDENTITY ?= $(shell security find-identity -v -p codesigning 2>/dev/null | sed -n 's/.*"\(Developer ID Application[^"]*\)".*/\1/p' | head -1)
+
+# Signed macOS release binaries in .build/release/. Runs on the Mac that holds
+# the cert; codesign and the identity do not exist elsewhere.
+release-mac:
+	@if [ -z "$(SIGN_IDENTITY)" ]; then echo "no Developer ID Application identity in the keychain"; exit 1; fi
+	GOOS=darwin GOARCH=arm64 go build -ldflags "-s -w $(LDFLAGS)" -o .build/release/aperture_darwin_arm64 ./cmd/aperture
+	GOOS=darwin GOARCH=amd64 go build -ldflags "-s -w $(LDFLAGS)" -o .build/release/aperture_darwin_amd64 ./cmd/aperture
+	codesign --options runtime --timestamp --sign "$(SIGN_IDENTITY)" .build/release/aperture_darwin_arm64 .build/release/aperture_darwin_amd64
+	codesign --verify --verbose=2 .build/release/aperture_darwin_arm64 .build/release/aperture_darwin_amd64