diff --git a/macos/WhisperDictate.entitlements b/macos/WhisperDictate.entitlements
index 8454dbf..d6f9fed 100644
--- a/macos/WhisperDictate.entitlements
+++ b/macos/WhisperDictate.entitlements
@@ -12,5 +12,12 @@
 	     hardened runtime's same-Team-ID check. -->
 	<key>com.apple.security.cs.disable-library-validation</key>
 	<true/>
+	<!-- Hardened-runtime resource-access entitlement. REQUIRED for microphone
+	     access under the hardened runtime: without it tccd refuses to even
+	     prompt and denies kTCCServiceMicrophone outright, so the app records
+	     silence (and whisper hallucinates on the empty audio). Must be present
+	     on any Developer ID / notarized build. -->
+	<key>com.apple.security.device.audio-input</key>
+	<true/>
 </dict>
 </plist>