diff --git a/pkg/mac/codesign-binaries.sh b/pkg/mac/codesign-binaries.sh
index 22e43dd29..6737aaf5c 100755
--- a/pkg/mac/codesign-binaries.sh
+++ b/pkg/mac/codesign-binaries.sh
@@ -20,7 +20,8 @@ if [ -z "${DEVELOPER_BUNDLE_ID}" ]; then
 fi
 
 echo Signing ${BUNDLE} binaries
-for i in `find "${BUNDLE}" -type f`
+IFS=$'\n'
+for i in $(find "${BUNDLE}" -type f)
 do
 	file "${i}" | grep -E "Mach-O executable|Mach-O 64-bit executable|Mach-O 64-bit bundle"
 	if [ $? -eq 0 ] ; then
@@ -28,13 +29,13 @@ do
 		# when the signing server is macOS 10.9 and codesign recommends to use
 		# 10.13 or later and XCode 10 or later.
 		# error: invalid or inappropriate API flag(s) specified
-		codesign --deep -f -i "${DEVELOPER_BUNDLE_ID}" -s "${DEVELOPER_ID}" --options runtime "${i}"
+		codesign --deep -f -i "${DEVELOPER_BUNDLE_ID}" -s "${DEVELOPER_ID}" --options runtime \"${i}\"
 	fi
 done
 
 echo Signing ${BUNDLE} libraries
-for i in `find "${BUNDLE}" -type f -name "*.dylib*"`
+for i in $(find "${BUNDLE}" -type f -name "*.dylib*")
 do
-	codesign --deep -f -i "${DEVELOPER_BUNDLE_ID}" -s "${DEVELOPER_ID}" --options runtime "${i}"
+	codesign --deep -f -i "${DEVELOPER_BUNDLE_ID}" -s "${DEVELOPER_ID}" --options runtime \"${i}\"
 done