diff --git a/.github/workflows/build-macos.yml b/.github/workflows/build-macos.yml
index b8b79bca4..84176d276 100644
--- a/.github/workflows/build-macos.yml
+++ b/.github/workflows/build-macos.yml
@@ -407,11 +407,21 @@ jobs:
           ZIP="$RUNNER_TEMP/notarize.zip"
           # ditto, not zip: it keeps the bundle's symlinks and extended attributes.
           ditto -c -k --keepParent "$APP" "$ZIP"
-          xcrun notarytool submit "$ZIP" \
-            --key "$RUNNER_TEMP/macos-signing/private_keys/AuthKey_${APPLE_KEY_ID}.p8" \
-            --key-id "$APPLE_KEY_ID" --issuer "$APPLE_ISSUER_ID" \
-            --wait --timeout 45m
+          auth=(--key "$RUNNER_TEMP/macos-signing/private_keys/AuthKey_${APPLE_KEY_ID}.p8"
+                --key-id "$APPLE_KEY_ID" --issuer "$APPLE_ISSUER_ID")
+          # notarytool exits 0 on Invalid too; the status decides, and a refusal
+          # prints Apple's own log, which names each offending binary.
+          xcrun notarytool submit "$ZIP" "${auth[@]}" --wait --timeout 45m \
+            --output-format json > "$RUNNER_TEMP/notary.json"
           rm -f "$ZIP"
+          id="$(plutil -extract id raw "$RUNNER_TEMP/notary.json")"
+          status="$(plutil -extract status raw "$RUNNER_TEMP/notary.json")"
+          echo "notary submission $id: $status"
+          if [ "$status" != "Accepted" ]; then
+            xcrun notarytool log "$id" "${auth[@]}" || true
+            echo "FATAL: the notary service returned '$status' for submission $id"
+            exit 1
+          fi
           xcrun stapler staple "$APP"
           xcrun stapler validate "$APP"
           # What a user's Mac will decide on first launch, asked of this one.
diff --git a/scripts/macos/build_signed.sh b/scripts/macos/build_signed.sh
index 74675b350..6f7c1f0dc 100755
--- a/scripts/macos/build_signed.sh
+++ b/scripts/macos/build_signed.sh
@@ -50,11 +50,15 @@ echo "signing identity: $identity" >&2
 
 # The profile specifier is a Runner-only setting (project.pbxproj reads it from
 # HASH_BAGS_MACOS_PROFILE), so the pods never see a profile they would refuse.
+# `xcodebuild build`, unlike `archive`, injects com.apple.security.get-task-allow
+# into the signature; the notary service rejects any executable carrying it.
+# CODE_SIGN_INJECT_BASE_ENTITLEMENTS=NO keeps the entitlements to our own file.
 xcodebuild -workspace macos/Runner.xcworkspace -scheme Runner \
     -configuration Release -derivedDataPath "$derived" \
     CODE_SIGN_IDENTITY="$identity" \
     DEVELOPMENT_TEAM="$team" \
     HASH_BAGS_MACOS_PROFILE="$name" \
+    CODE_SIGN_INJECT_BASE_ENTITLEMENTS=NO \
     OTHER_CODE_SIGN_FLAGS="--keychain $keychain --timestamp" \
     "$@" build >&2
 
@@ -68,6 +72,11 @@ if grep -q '\$(' "$work/entitlements.plist"; then
     grep '\$(' "$work/entitlements.plist" >&2
     exit 1
 fi
+if grep -q 'get-task-allow' "$work/entitlements.plist"; then
+    # Notarization and App Store review both reject it, minutes later and remotely.
+    echo "FATAL: $app is signed with com.apple.security.get-task-allow, a debug-only entitlement" >&2
+    exit 1
+fi
 [ -f "$app/Contents/embedded.provisionprofile" ] || {
     echo "FATAL: $app carries no embedded provisioning profile" >&2; exit 1; }