diff --git a/build/entitlements.mas.plist b/build/entitlements.mas.plist
index 81caf9441..a101240dd 100644
--- a/build/entitlements.mas.plist
+++ b/build/entitlements.mas.plist
@@ -10,7 +10,5 @@
     <true/>
     <key>com.apple.security.network.client</key>
     <true/>
-    <key>ITSAppUsesNonExemptEncryption</key>
-    <false/>
   </dict>
 </plist>
diff --git a/forge.config.cts b/forge.config.cts
index 13da196e4..ba049851a 100644
--- a/forge.config.cts
+++ b/forge.config.cts
@@ -130,6 +130,7 @@ const config: ForgeConfig = {
       keychain: process.env.OSX_SIGN_KEYCHAIN_PATH,
       identity: process.env.OSX_SIGN_IDENTITY,
       provisioningProfile: process.env.OSX_SIGN_PROVISIONING_PROFILE_PATH,
+      preAutoEntitlements: platform !== "mas",
     },
     ...(process.env.APPLE_ID &&
       process.env.APPLE_PASSWORD &&