diff --git a/packaging/build_macos_signed.sh b/packaging/build_macos_signed.sh
index e1566049e..a073354fd 100755
--- a/packaging/build_macos_signed.sh
+++ b/packaging/build_macos_signed.sh
@@ -121,8 +121,8 @@ else
         -s "$DEVELOPER_ID" "$APP"
 fi
 codesign --verify --deep --strict --verbose=2 "$APP"
-codesign -d --entitlements - "$APP/Contents/PlugIns/DWGThumbnail.appex" \
-    | python3 -c 'import plistlib, sys; assert plistlib.load(sys.stdin.buffer).get("com.apple.security.app-sandbox") is True'
+codesign -d --entitlements - --xml "$APP/Contents/PlugIns/DWGThumbnail.appex" \
+    | python3 -c 'import io, plistlib, sys; assert plistlib.load(io.BytesIO(sys.stdin.buffer.read())).get("com.apple.security.app-sandbox") is True'
 
 echo "==> dmg"
 DMG="$DIST/OpenCADStudio-v$VERSION-macos-arm64.dmg"