diff --git a/src/wx/CMakeLists.txt b/src/wx/CMakeLists.txt
index 3ac87d96..48e2fcd3 100644
--- a/src/wx/CMakeLists.txt
+++ b/src/wx/CMakeLists.txt
@@ -1202,35 +1202,25 @@ if(APPLE AND (UPSTREAM_RELEASE OR ENABLE_ONLINEUPDATES))
         endif()
     endif()
 
-    if(DEFINED ENV{LOGIN_KEYCHAIN_PASSWORD})
-        add_custom_command(
-            TARGET visualboyadvance-m
-            POST_BUILD
-            COMMAND /bin/sh -c "security unlock-keychain -p \"$$LOGIN_KEYCHAIN_PASSWORD\" ~/Library/Keychains/login.keychain*"
-        )
+    add_custom_command(
+        TARGET visualboyadvance-m
+        POST_BUILD
+        COMMAND codesign --sign "Developer ID Application" --force --deep ./visualboyadvance-m.app
+        WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
+    )
 
-        add_custom_command(
-            TARGET visualboyadvance-m
-            POST_BUILD
-            COMMAND codesign --sign "Developer ID Application" --force --deep ./visualboyadvance-m.app
-            WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
-        )
-
-        if(EXISTS ${CMAKE_BINARY_DIR}/visualboyadvance-m.app/Contents/Frameworks)
-            # Sign frameworks individually, like Xcode.
-            file(GLOB frameworks ${CMAKE_BINARY_DIR}/visualboyadvance-m.app/Contents/Frameworks/*)
-            foreach(framework ${frameworks})
-                message(STATUS "Signing framework: " ${framework})
-                add_custom_command(
-                    TARGET visualboyadvance-m
-                    POST_BUILD
-                    COMMAND codesign --sign "Developer ID Application" --force ${framework}
-                    WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
-                )
-            endforeach()
-        endif()
-    else()
-        message(WARNING "Set the environment variable LOGIN_KEYCHAIN_PASSWORD to your login keychain password to codesign.")
+    if(EXISTS ${CMAKE_BINARY_DIR}/visualboyadvance-m.app/Contents/Frameworks)
+        # Sign frameworks individually, like Xcode.
+        file(GLOB frameworks ${CMAKE_BINARY_DIR}/visualboyadvance-m.app/Contents/Frameworks/*)
+        foreach(framework ${frameworks})
+            message(STATUS "Signing framework: " ${framework})
+            add_custom_command(
+                TARGET visualboyadvance-m
+                POST_BUILD
+                COMMAND codesign --sign "Developer ID Application" --force ${framework}
+                WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
+            )
+        endforeach()
     endif()
 
     if(UPSTREAM_RELEASE)
@@ -1240,7 +1230,7 @@ if(APPLE AND (UPSTREAM_RELEASE OR ENABLE_ONLINEUPDATES))
             TARGET visualboyadvance-m
             POST_BUILD
             COMMAND ${CMAKE_COMMAND} -E remove ${appzip}
-            COMMAND ${ZIP_PROGRAM} -9r ${appzip} ./visualboyadvance-m.app
+            COMMAND ${ZIP_PROGRAM} -9yr ${appzip} ./visualboyadvance-m.app
             WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
         )
 
diff --git a/tools/osx/builder b/tools/osx/builder
index 07e4f62b..7ff35751 100755
--- a/tools/osx/builder
+++ b/tools/osx/builder
@@ -65,10 +65,9 @@ fi
 
 . "$(dirname "$0")/../builder/core.sh"
 
-table_line_remove DISTS flex
-table_line_remove DISTS libsecret
-table_line_remove DISTS c2man
-table_line_remove DISTS graphviz
+for dist in flex libsecret c2man graphviz zip; do
+    table_line_remove DISTS "$dist"
+done
 
 # issues with perl modules linked to our libs and brew perl
 table_line_remove DISTS shared-mime-info