Thanks for responding. Unfortunately, this doesn't work for us as the required entitlement (com.apple.developer.endpoint-security.client) is a privileged entitlement and therefore, would require Nix to move to exclusively binary distribution which goes against the principles of the package manger We would prefer to be able to still build nix implementations from source and patch them, which requires adhoc signing and doesn't work with the required entitlement