diff --git a/.gitignore b/.gitignore
index 54852db..2dfa3b7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,4 +9,4 @@ updateall_log.txt
 etc
 snap-*
 LICENSE.html
-Dockerfile
\ No newline at end of file
+certificates/
\ No newline at end of file
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 5d9abb2..6dd6bcc 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -13,19 +13,18 @@ variables:
     -Djava.awt.headless=true
     -Dmaven.test.skip=true
     -Dnetbeans.verify.integrity=false
-  # DOCKER_BUILD_TOOL: buildah
   DOCKER_REGISTRY_MIRROR: docker.snap-ci.ovh
   DOCKER_REGISTRY_USER: $NEXUS_USER
   DOCKER_REGISTRY_PASSWORD: $NEXUS_PASSWORD
   DOCKER_FILE: "docker/build/Dockerfile"
   DOCKER_CONTEXT_PATH: "${CI_PROJECT_DIR}"
-  DOCKER_SNAPSHOT_IMAGE: "$NEXUS_URL/$CI_PROJECT_NAME:unix-snapshot-latest"
-  DOCKER_RELEASE_IMAGE: "$NEXUS_URL/$CI_PROJECT_NAME:unix-latest"
+  DOCKER_SNAPSHOT_IMAGE: "$NEXUS_URL/$CI_PROJECT_NAME:unix-snapshot-pRC10"
+  DOCKER_RELEASE_IMAGE: "$NEXUS_URL/$CI_PROJECT_NAME:unix-pRC10"
   DOCKER_TRIVY_ARGS: "${DOCKER_TRIVY_ARGS} --timeout 15m"
-  DOCKER_BUILD_ARGS: "--cache=true --compressed-caching=false --use-new-run --cleanup --build-arg LICENSE=${INSTALL4J_LICENSE} --build-arg=UPLOAD_URL --build-arg=NEXUS_USER --build-arg=NEXUS_PASS --target=unix"
+  DOCKER_BUILD_ARGS: "--cache=true --compressed-caching=false --use-new-run --cleanup --build-arg LICENSE=${INSTALL4J_LICENSE} --build-arg=UPLOAD_URL --build-arg=NEXUS_USER --build-arg=NEXUS_PASS --build-arg=MACOS_SIGNING --target=unix"
   DOCKER_HADOLINT_ARGS: --failure-threshold error
   DOCKER_PROD_PUBLISH_STRATEGY: auto
-  COMPILE_BRANCH: master
+  COMPILE_BRANCH: release-pRC-10
   RECOMPILE: "true"
 
 stages:
@@ -67,6 +66,11 @@ build:
         COMPILE_BRANCH: $BRANCH
       when: always
     - when: always
+  image: registry.hub.docker.com/library/ubuntu:latest
+  before_script:
+    - apt-get -qq update && apt-get -qqy upgrade && apt-get -qqy install curl
+  script:
+    - curl -s https://gitlab.com/gitlab-org/incubation-engineering/mobile-devops/download-secure-files/-/raw/main/installer | bash
   needs:
     - job: compile
       # optional: true
@@ -90,10 +94,10 @@ build:
       job: mvn-build
       ref: $COMPILE_BRANCH
       artifacts: true
-  script: echo build-snap
   artifacts:
     expire_in: 2 hours
     paths:
+      - $SECURE_FILES_DOWNLOAD_PATH
       - LICENSE.html
       - etc
       - "${CI_PROJECT_DIR}/snap-application/target"
diff --git a/README.md b/README.md
index 0aeedf9..f32bea2 100644
--- a/README.md
+++ b/README.md
@@ -28,6 +28,8 @@ In case you want to build the docker image locally
 
 Then `docker run -i -l snap-installer docker-hosted.snap-ci.ovh/snap-installer:latest`
 
+> Note: you have to either create a `certificates` folder at project root and put the snap certificate for macos or edit snap.install4j file.
+
 ### Pull snap docker image
 
 `docker pull docker.snap-ci.ovh/snap-installer:latest`
diff --git a/docker/build/Dockerfile b/docker/build/Dockerfile
index 68de075..7532a3a 100644
--- a/docker/build/Dockerfile
+++ b/docker/build/Dockerfile
@@ -140,6 +140,7 @@ RUN mkdir -p ${DEST}/snap-installer ${DEST}/snap-installer/files ${DEST}/snap-in
     ${DEST}/opttbx-kit/target/netbeans_clusters/opttbx/
 
 COPY snap.install4j LICENSE.txt VERSION.txt ${DEST}/snap-installer/
+COPY certificates/ ${DEST}/certificates/
 COPY files/ ${DEST}/snap-installer/files/
 COPY images/ ${DEST}/snap-installer/images/
 COPY LICENSE.html ${DEST}/snap-engine/
@@ -161,9 +162,10 @@ COPY smos-kit/target/netbeans_clusters/smos/ ${DEST}/smos-box/smos-kit/target/ne
 
 # Create installers
 ARG LICENSE
+ARG MACOS_SIGNING
 ARG USER_HOME_DIR="/home/snap"
 
-RUN install4jc -q -d ${USER_HOME_DIR} -L ${LICENSE} -m unixInstaller,macosFolder,windows ${DEST}/snap-installer/snap.install4j && \
+RUN install4jc -q -d ${USER_HOME_DIR} -L ${LICENSE} -m unixInstaller,macosFolder,windows ${DEST}/snap-installer/snap.install4j --mac-keystore-password=MACOS_SIGNING --disable-notarization  && \
     chmod 777 ${USER_HOME_DIR}/esa-* && \
     rm ${USER_HOME_DIR}/*x32* && rm ${USER_HOME_DIR}/*smos* && rm ${USER_HOME_DIR}/*sentinel* && \
     rm -rf ${DEST} \
diff --git a/docker/build/scripts/upload.sh b/docker/build/scripts/upload.sh
index 28006e0..753c747 100755
--- a/docker/build/scripts/upload.sh
+++ b/docker/build/scripts/upload.sh
@@ -10,7 +10,7 @@ do
     if [[ "${file}" =~ ^esa-snap_all* ]]
     then
         export OS=$(echo "$file" | grep -oP  "(unix|windows|macos)")
-        export VERSION=$(echo "$file" | grep -oP  "(1[0-9]{1,2})(_)([0-9]*)(_)([0-9]*)")
+        export VERSION=pRC10
         export EXT=""
         export GROUP="installers"
         export REPO="snap-maven-releases"
diff --git a/snap.install4j b/snap.install4j
index 1b84ef0..6d209a4 100644
--- a/snap.install4j
+++ b/snap.install4j
@@ -10,6 +10,7 @@
       <variable name="snapGptMenuName" value="SNAP GPT" />
       <variable name="smosGridPointExporter" value="smos-grid-point-exporter" />
     </variables>
+    <codeSigning macEnabled="true" macPkcs12File="../certificates/apple-dev-certificates.p12" />
     <jreBundles jdkProviderId="Liberica" release="11/11.0.19+7" />
   </application>
   <files missingFilesStrategy="error" defaultUninstallMode="2" launcherOverwriteMode="1">
@@ -1933,5 +1934,5 @@ return console.askYesNo(message, true);
   <buildIds buildAll="false">
     <mediaSet refId="3551" />
   </buildIds>
-  <buildOptions faster="true" disableSigning="true" />
+  <buildOptions faster="true" disableSigning="false" />
 </install4j>