diff --git a/FinderExtension/KotejFinder.entitlements b/FinderExtension/KotejFinder.entitlements
new file mode 100644
index 0000000..3524be1
--- /dev/null
+++ b/FinderExtension/KotejFinder.entitlements
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <!-- macOS only loads Finder Sync extensions that are sandboxed; without this
+         pluginkit ignores the appex without reporting anything. -->
+    <key>com.apple.security.app-sandbox</key>
+    <true/>
+    <!-- Needed to read the URLs of the items selected in Finder. -->
+    <key>com.apple.security.files.user-selected.read-only</key>
+    <true/>
+</dict>
+</plist>
diff --git a/project.yml b/project.yml
index 6f70557..72ed628 100644
--- a/project.yml
+++ b/project.yml
@@ -13,7 +13,7 @@ settings:
     DEVELOPMENT_TEAM: "2825Q76T7H"
     CODE_SIGN_STYLE: Automatic
 packages:
-  KotejEngine:
+  Kotej:
     path: .
 targets:
   Kotej:
@@ -27,7 +27,7 @@ targets:
       - path: Resources
         buildPhase: resources
     dependencies:
-      - package: KotejEngine
+      - package: Kotej
         product: KotejEngine
       - target: KotejFinder
     settings:
@@ -61,8 +61,9 @@ targets:
     settings:
       base:
         PRODUCT_BUNDLE_IDENTIFIER: com.alexandrev.kotej.finder
-        ENABLE_APP_SANDBOX: NO
+        ENABLE_APP_SANDBOX: YES
         ENABLE_HARDENED_RUNTIME: YES
+        CODE_SIGN_ENTITLEMENTS: FinderExtension/KotejFinder.entitlements
     info:
       path: FinderExtension/Info.plist
       properties: