diff --git a/eclipse-distribution/org.springframework.boot.ide.product.e413/macos-notarize.sh b/eclipse-distribution/org.springframework.boot.ide.product.e413/macos-notarize.sh
new file mode 100755
index 000000000..d6f812b18
--- /dev/null
+++ b/eclipse-distribution/org.springframework.boot.ide.product.e413/macos-notarize.sh
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+
+DMG=$1
+NOTARIZE_SERVICE_URL=$2
+
+RESPONSE=\
+$(curl -s -X POST \
+  -F file=@${DMG} \
+  -F 'options={"primaryBundleId": "SpringTools4", "staple": true};type=application/json' \
+  ${NOTARIZE_SERVICE_URL}/macos-notarization-service/notarize)
+	  
+echo "Notarization request submitted"
+  
+UUID=$(echo ${RESPONSE} | jq -r '.uuid')
+
+STATUS=$(echo ${RESPONSE} | jq -r '.notarizationStatus.status')
+
+while [[ ${STATUS} == 'IN_PROGRESS' ]]; do
+  sleep 1m
+  RESPONSE=$(curl -s ${NOTARIZE_SERVICE_URL}/macos-notarization-service/${UUID}/status)
+  STATUS=$(echo ${RESPONSE} | jq -r '.notarizationStatus.status')
+done
+
+if [[ ${STATUS} != 'COMPLETE' ]]; then
+  echo "Notarization failed: ${RESPONSE}"
+  exit 1
+fi
+
+mv "${DMG}" "${DMG}-unnotarized"
+
+curl -o ${DMG} -J ${NOTARIZE_SERVICE_URL}/macos-notarization-service/${UUID}/download
diff --git a/eclipse-distribution/org.springframework.boot.ide.product.e413/pom.xml b/eclipse-distribution/org.springframework.boot.ide.product.e413/pom.xml
index 24c19f32a..92857d559 100644
--- a/eclipse-distribution/org.springframework.boot.ide.product.e413/pom.xml
+++ b/eclipse-distribution/org.springframework.boot.ide.product.e413/pom.xml
@@ -132,6 +132,7 @@
 				<version>1.7</version>
 				<executions>
 
+					<!-- macos code signing requires the build to run on a macOS machine with Xcode installed, including the appropriate Apple Developer certificates for code signing -->
 					<execution>
 						<id>osx-app-signing</id>
 						<phase>package</phase>
@@ -150,7 +151,7 @@
 								    <arg value="--keychain"/>
 								    <arg value="${env.KEYCHAIN}"/>
 								    <arg value="-s"/>
-								    <arg value="Developer ID Application: Trevor Marshall"/>
+								    <arg value="${env.MACOS_CERTIFICATE_ID}"/>
 								    <arg value="${project.build.directory}/products/org.springframework.boot.ide.branding.sts4/macosx/cocoa/x86_64/SpringToolSuite4.app"/>
 								</exec>
 
@@ -161,6 +162,7 @@
 						</goals>
 					</execution>
 
+					<!-- the creation of the DMG file is based on appdmg: https://www.npmjs.com/package/appdmg -->
 					<execution>
 						<id>osx-dmg-creation</id>
 						<phase>verify</phase>
@@ -197,7 +199,7 @@
 								    <arg value="--keychain"/>
 								    <arg value="${env.KEYCHAIN}"/>
 								    <arg value="-s"/>
-								    <arg value="Developer ID Application: Trevor Marshall"/>
+								    <arg value="${env.MACOS_CERTIFICATE_ID}"/>
 								    <arg value="${dmgName}"/>
 								</exec>
 
@@ -208,6 +210,29 @@
 						</goals>
 					</execution>
 
+					<!-- the notarizing of the DMG file needs this service running somewhere: https://github.com/eclipse-cbi/macos-notarization-service -->
+					<execution>
+						<id>osx-dmg-notarizing</id>
+						<phase>verify</phase>
+						<configuration>
+							<skip>${skip.osx.notarizing}</skip>
+							<target>
+
+								<property name="dmgName" value="${project.build.directory}/products/spring-tool-suite-4-${unqualifiedVersion}.${p2.qualifier}-${dist.target}-macosx.cocoa.x86_64.dmg" />
+
+								<exec executable="/bin/bash" failonerror="true">
+									<arg value="${project.build.directory}/../macos-notarize.sh"/>
+									<arg value="${dmgName}"/>
+								    <arg value="${env.MACOS_NOTARIZATION_SERVICE_URL}"/>
+								</exec>
+
+							</target>
+						</configuration>
+						<goals>
+							<goal>run</goal>
+						</goals>
+					</execution>
+
 					<execution>
 						<id>upload-product-bundles</id>
 						<phase>deploy</phase>
diff --git a/eclipse-distribution/pom.xml b/eclipse-distribution/pom.xml
index cf981a9b6..9d7edf194 100644
--- a/eclipse-distribution/pom.xml
+++ b/eclipse-distribution/pom.xml
@@ -55,8 +55,9 @@
 		<signing.alias>pivotal</signing.alias>
 		<signing.keystore>~/.keytool/pivotal.jks</signing.keystore>
 
-		<!-- OSX app signing -->
+		<!-- OSX app signing and notarizing-->
 		<skip.osx.signing>true</skip.osx.signing>
+		<skip.osx.notarizing>true</skip.osx.notarizing>
 
 		<dist.name>Spring Tool Suite 4</dist.name>