diff --git a/.github/workflows/build-mac-notarized.yml b/.github/workflows/build-mac-notarized.yml
new file mode 100644
index 00000000..74a80001
--- /dev/null
+++ b/.github/workflows/build-mac-notarized.yml
@@ -0,0 +1,56 @@
+name: Build and notarize macOS app
+on:
+  workflow_dispatch:
+
+env:
+  APP_NAME: Yattee
+  FASTLANE_USER: ${{ secrets.FASTLANE_USER }}
+  FASTLANE_PASSWORD: ${{ secrets.FASTLANE_PASSWORD }}
+  ITC_TEAM_ID: ${{ secrets.ITC_TEAM_ID }}
+  TEAM_ID: ${{ secrets.TEAM_ID }}
+  DEVELOPER_KEY_ID: ${{ secrets.DEVELOPER_KEY_ID }}
+  DEVELOPER_KEY_ISSUER_ID: ${{ secrets.DEVELOPER_KEY_ISSUER_ID }}
+  DEVELOPER_KEY_CONTENT: ${{ secrets.DEVELOPER_KEY_CONTENT }}
+  TEMP_KEYCHAIN_USER: ${{ secrets.TEMP_KEYCHAIN_USER }}
+  TEMP_KEYCHAIN_PASSWORD: ${{ secrets.TEMP_KEYCHAIN_PASSWORD }}
+  DEVELOPER_APP_IDENTIFIER: ${{ secrets.DEVELOPER_APP_IDENTIFIER }}
+  GIT_AUTHORIZATION: ${{ secrets.GIT_AUTHORIZATION }}
+  MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
+  CERTIFICATES_GIT_URL: ${{ secrets.CERTIFICATES_GIT_URL }}
+
+jobs:
+  mac_notarized:
+    name: Build and notarize macOS app
+    runs-on: macos-15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.1'
+          bundler-cache: true
+          cache-version: 1
+      - name: Replace signing certificate to Direct with Developer ID
+        run: |
+          sed -i '' 's/match AppStore/match Direct/' Yattee.xcodeproj/project.pbxproj
+          sed -i '' 's/3rd Party Mac Developer Application/Developer ID Application/' Yattee.xcodeproj/project.pbxproj
+      - uses: maxim-lobanov/setup-xcode@v1
+        with:
+          xcode-version: '16.4'
+      - name: Clear SPM cache
+        run: rm -rf ~/Library/Caches/org.swift.swiftpm/artifacts
+      - uses: maierj/fastlane-action@v3.0.0
+        with:
+          lane: mac build_and_notarize
+      - run: |
+          echo "BUILD_NUMBER=$(cat Yattee.xcodeproj/project.pbxproj | grep -m 1 CURRENT_PROJECT_VERSION | cut -d' ' -f3 | sed 's/;//g')" >> $GITHUB_ENV
+          echo "VERSION_NUMBER=$(cat Yattee.xcodeproj/project.pbxproj | grep -m 1 MARKETING_VERSION | cut -d' ' -f3 | sed 's/;//g')" >> $GITHUB_ENV
+      - run: |
+          echo "APP_PATH=fastlane/builds/${{ env.VERSION_NUMBER }}-${{ env.BUILD_NUMBER }}/macOS/Yattee.app" >> $GITHUB_ENV
+          echo "ZIP_PATH=fastlane/builds/${{ env.VERSION_NUMBER }}-${{ env.BUILD_NUMBER }}/macOS/Yattee-${{ env.VERSION_NUMBER }}-macOS.zip" >> $GITHUB_ENV
+      - name: ZIP build
+        run: /usr/bin/ditto -c -k --keepParent ${{ env.APP_PATH }} ${{ env.ZIP_PATH }}
+      - uses: actions/upload-artifact@v4
+        with:
+          name: mac-notarized-build
+          path: ${{ env.ZIP_PATH }}
+          if-no-files-found: error