diff --git a/macos/WhisperDictate.entitlements b/macos/WhisperDictate.entitlements
index d6f9fed..cbd6748 100644
--- a/macos/WhisperDictate.entitlements
+++ b/macos/WhisperDictate.entitlements
@@ -19,5 +19,10 @@
 	     on any Developer ID / notarized build. -->
 	<key>com.apple.security.device.audio-input</key>
 	<true/>
+	<!-- whisper.cpp's Metal/ggml backend generates code at runtime; the
+	     hardened runtime needs allow-jit so the bundled whisper-cli/dylibs
+	     don't get killed for JIT. -->
+	<key>com.apple.security.cs.allow-jit</key>
+	<true/>
 </dict>
 </plist>