diff --git a/CMakeLists.txt b/CMakeLists.txt
index fbd3eda8ec..fe4f399ed8 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -790,8 +790,8 @@ endif()
 
 # Apple bundling
 if (OPENMW_OSX_DEPLOYMENT AND APPLE)
-    if (CMAKE_VERSION VERSION_GREATER_EQUAL 3.13 AND CMAKE_VERSION VERSION_LESS 3.13.4)
-        message(FATAL_ERROR "macOS packaging is broken in early CMake 3.13 releases, see https://gitlab.com/OpenMW/openmw/issues/4767. Please use at least 3.13.4 or an older version like 3.12.4")
+    if (CMAKE_VERSION VERSION_LESS 3.19)
+        message(FATAL_ERROR "macOS packaging requires CMake 3.19 or higher to sign macOS app bundles.")
     endif ()
 
     get_property(QT_COCOA_PLUGIN_PATH TARGET Qt5::QCocoaIntegrationPlugin PROPERTY LOCATION_RELEASE)
@@ -887,6 +887,9 @@ if (OPENMW_OSX_DEPLOYMENT AND APPLE)
         fixup_bundle(\"${INSTALLED_OPENMW_APP}\" \"${PLUGINS}\" \"\")
         fixup_bundle(\"${INSTALLED_OPENCS_APP}\" \"${OPENCS_PLUGINS}\" \"\")
         " COMPONENT Runtime)
+
+    set(CPACK_PRE_BUILD_SCRIPTS ${CMAKE_SOURCE_DIR}/cmake/SignMacApplications.cmake)
+
     include(CPack)
 elseif(NOT APPLE)
     get_generator_is_multi_config(multi_config)
diff --git a/cmake/SignMacApplications.cmake b/cmake/SignMacApplications.cmake
new file mode 100644
index 0000000000..bcecb10491
--- /dev/null
+++ b/cmake/SignMacApplications.cmake
@@ -0,0 +1,21 @@
+# This script re-signs OpenMW.app and OpenMW-CS.app after CPack packages them. This is necessary because CPack modifies
+# the library references used by OpenMW to App relative paths, invalidating the code signature.
+
+# Obviously, we only need to run this on Apple targets.
+if (APPLE)
+    set(OPENMW_APP "OpenMW")
+    set(OPENMW_CS_APP "OpenMW-CS")
+
+    set(APPLICATIONS "${OPENMW_APP}" "${OPENMW_CS_APP}")
+    foreach(app_name IN LISTS APPLICATIONS)
+        set(FULL_APP_PATH "${CPACK_TEMPORARY_INSTALL_DIRECTORY}/ALL_IN_ONE/${app_name}.app")
+        message(STATUS "Re-signing ${app_name}.app")
+        # Apple's codesign utility does not like directories with periods (.) in their names, so we'll remove it and
+        # create a symlink using the original name, which codesign is fine with.
+        file(GLOB OSG_PLUGINS_DIR "${FULL_APP_PATH}/Contents/PlugIns/osgPlugins*")
+        file(RENAME "${OSG_PLUGINS_DIR}" "${FULL_APP_PATH}/Contents/PlugIns/osgPlugins")
+        execute_process(COMMAND "ln" "-s" "osgPlugins" "${OSG_PLUGINS_DIR}"
+                        WORKING_DIRECTORY "${FULL_APP_PATH}/Contents/PlugIns/")
+        execute_process(COMMAND "codesign" "--force" "--deep" "-s" "-" "${FULL_APP_PATH}")
+    endforeach(app_name)
+endif (APPLE)
\ No newline at end of file