diff --git a/solenv/bin/macosx-codesign-app-bundle b/solenv/bin/macosx-codesign-app-bundle
index cdbf7ce964ae..695b3ae97922 100755
--- a/solenv/bin/macosx-codesign-app-bundle
+++ b/solenv/bin/macosx-codesign-app-bundle
@@ -24,10 +24,13 @@ done
 
 APP_BUNDLE="$1"
 entitlements=
+entitlements_helper=
 application_identifier=
 if test -n "$ENABLE_MACOSX_SANDBOX"; then
     # In a sandboxed build executables need the entitlements
     entitlements="--entitlements $BUILDDIR/lo.xcent"
+    # helper utilities must be signed with only the sandbox and inherit entitlements
+    entitlements_helper="--entitlements $SRCDIR/sysui/desktop/macosx/sandbox_inherit.entitlements"
     application_identifier=`/usr/libexec/PlistBuddy -c "print com.apple.application-identifier"  $BUILDDIR/lo.xcent`
     # remove the key from the entitlement - only use it when signing the whole bundle in the final step
     /usr/libexec/PlistBuddy -c "delete com.apple.application-identifier"  $BUILDDIR/lo.xcent
@@ -39,6 +42,7 @@ if test -n "$ENABLE_MACOSX_SANDBOX"; then
 else
     # We then want to sign data files, too, hmm.
     entitlements="--entitlements $BUILDDIR/hardened_runtime.xcent"
+    entitlements_helper=$entitlements
     other_files="\
  -or -name '*.fodt' -or -name 'schema.strings' -or -name 'schema.xml' \
  -or -name '*.jar' -or -name 'LICENSE' -or -name 'LICENSE.html' \
@@ -127,7 +131,7 @@ while read file; do
 	    ;;
 	*)
 	    id=`echo ${file#${APP_BUNDLE}/Contents/} | sed -e 's,/,.,g'`
-	    codesign --force --timestamp --options=runtime --identifier=$MACOSX_BUNDLE_IDENTIFIER.$id --sign "$MACOSX_CODESIGNING_IDENTITY" $entitlements "$file" || exit 1
+	    codesign --force --timestamp --options=runtime --identifier=$MACOSX_BUNDLE_IDENTIFIER.$id --sign "$MACOSX_CODESIGNING_IDENTITY" $entitlements_helper "$file" || exit 1
 	    ;;
     esac
 done
diff --git a/sysui/desktop/macosx/sandbox_inherit.entitlements b/sysui/desktop/macosx/sandbox_inherit.entitlements
new file mode 100644
index 000000000000..794eada1cad3
--- /dev/null
+++ b/sysui/desktop/macosx/sandbox_inherit.entitlements
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.security.app-sandbox</key>
+	<true/>
+	<key>com.apple.security.inherit</key>
+	<true/>
+</dict>
+</plist>