diff --git a/lib/GHCup.hs b/lib/GHCup.hs
index 49bd93a..8b5eee2 100644
--- a/lib/GHCup.hs
+++ b/lib/GHCup.hs
@@ -2626,6 +2626,7 @@ upgradeGHCup :: ( MonadMask m
 upgradeGHCup mtarget force' = do
   Dirs {..} <- lift getDirs
   GHCupInfo { _ghcupDownloads = dls } <- lift getGHCupInfo
+  PlatformRequest {..} <- lift getPlatformReq
 
   lift $ logInfo "Upgrading GHCup..."
   let latestVer = fromJust $ fst <$> getLatest dls GHCup
@@ -2645,6 +2646,7 @@ upgradeGHCup mtarget force' = do
   copyFileE p
                                                            destFile
   lift $ chmod_755 destFile
+  liftE $ catchWarn $ lEM @_ @'[ProcessError] $ darwinCodeSign _rPlatform destFile
 
   liftIO (isInPath destFile) >>= \b -> unless b $
     lift $ logWarn $ T.pack (takeFileName destFile) <> " is not in PATH! You have to add it in order to use ghcup."
diff --git a/lib/GHCup/Utils.hs b/lib/GHCup/Utils.hs
index b64117f..a356b26 100644
--- a/lib/GHCup/Utils.hs
+++ b/lib/GHCup/Utils.hs
@@ -1028,6 +1028,17 @@ darwinNotarization Darwin path = exec
   Nothing
 darwinNotarization _ _ = pure $ Right ()
 
+darwinCodeSign :: (MonadReader env m, HasDirs env, MonadIO m)
+                   => Platform
+                   -> FilePath
+                   -> m (Either ProcessError ())
+darwinCodeSign Darwin path = exec
+  "codesign"
+  ["-s", "-", path]
+  Nothing
+  Nothing
+darwinCodeSign _ _ = pure $ Right ()
+
 
 getChangeLog :: GHCupDownloads -> Tool -> Either Version Tag -> Maybe URI
 getChangeLog dls tool (Left v') =
diff --git a/scripts/bootstrap/bootstrap-haskell b/scripts/bootstrap/bootstrap-haskell
index 2b32175..b82a129 100755
--- a/scripts/bootstrap/bootstrap-haskell
+++ b/scripts/bootstrap/bootstrap-haskell
@@ -296,6 +296,18 @@ download_ghcup() {
 		esac
 		EOF
 
+    case "${plat}" in
+        "Darwin"|"darwin")
+			case "${arch}" in
+				aarch64|arm64|armv8l)
+                    codesign -s - "${GHCUP_BIN}"/ghcup
+                    ;;
+                *) : ;;
+            esac
+            ;;
+        *) : ;;
+    esac
+
 	# shellcheck disable=SC1090
     edo . "${GHCUP_DIR}"/env
     eghcup upgrade