diff --git a/.gitignore b/.gitignore
index 0d99305f6..3d9afe258 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,6 +14,7 @@ benchmark.txt
 /cmd/prometheus/debug
 /benchout
 /cmd/promtool/data
+_CodeSignature
 
 !/.travis.yml
 !/.promu.yml
diff --git a/Makefile.common b/Makefile.common
index fc47bdbb2..bc6382023 100644
--- a/Makefile.common
+++ b/Makefile.common
@@ -201,7 +201,10 @@ common-unused:
 .PHONY: common-build
 common-build: promu
 	@echo ">> building binaries"
-	$(PROMU) build --prefix $(PREFIX) $(PROMU_BINARIES)
+	@$(PROMU) build --prefix $(PREFIX) $(PROMU_BINARIES) && \
+		if [ "$(GOHOSTOS)" = "darwin" ] && command -v codesign > /dev/null 2>&1; then \
+			codesign --sign - --force --preserve-metadata=entitlements,requirements,flags,runtime $(PREFIX) >/dev/null 2>&1; \
+		fi
 
 .PHONY: common-tarball
 common-tarball: promu