diff --git a/Makefile b/Makefile
index aff9ff6..15015a7 100644
--- a/Makefile
+++ b/Makefile
@@ -641,6 +641,10 @@ $$(PYTHON_XCFRAMEWORK-$(os))/Info.plist: \
 		2>&1 | tee -a $$(PYTHON_INSTALL-macosx)/python-$(os).codesign.log
 	find $$(PYTHON_FRAMEWORK-macosx) -name "*.so" -type f -exec codesign -s - --preserve-metadata=identifier,entitlements,flags,runtime -f {} \; \
 		2>&1 | tee -a $$(PYTHON_INSTALL-macosx)/python-$(os).codesign.log
+	find $$(PYTHON_INSTALL_VERSION-macosx)/bin -type f -perm +111 -exec sh -c 'file "$$$$1" | grep -q Mach-O' _ {} \; -exec codesign -s - --preserve-metadata=identifier,entitlements,flags,runtime -f {} \; \
+		2>&1 | tee -a $$(PYTHON_INSTALL-macosx)/python-$(os).codesign.log
+	codesign -s - --preserve-metadata=identifier,entitlements,flags,runtime -f $$(PYTHON_INSTALL_VERSION-macosx)/Resources/Python.app \
+		2>&1 | tee -a $$(PYTHON_INSTALL-macosx)/python-$(os).codesign.log
 	codesign -s - --preserve-metadata=identifier,entitlements,flags,runtime -f $$(PYTHON_FRAMEWORK-macosx) \
 		2>&1 | tee -a $$(PYTHON_INSTALL-macosx)/python-$(os).codesign.log
 
diff --git a/patch/Python/release.macOS.exclude b/patch/Python/release.macOS.exclude
index 3bc247c..2acaa6c 100644
--- a/patch/Python/release.macOS.exclude
+++ b/patch/Python/release.macOS.exclude
@@ -6,7 +6,6 @@
 ._Python
 ._Resources
 Resources/._Python.app
-Resources/Python.app
 Versions/._Current
 Versions/*/.__CodeSignature
 Versions/*/._bin
@@ -17,7 +16,9 @@ Versions/*/._include
 Versions/*/._lib
 Versions/*/._Resources
 Versions/*/._share
-Versions/*/bin
+Versions/*/bin/idle*
+Versions/*/bin/pydoc*
+Versions/*/bin/python*-config
 Versions/*/etc
 Versions/*/Frameworks
 Versions/*/lib/python*/idlelib
diff --git a/patch/make-relocatable.sh b/patch/make-relocatable.sh
index f268cd7..536b792 100755
--- a/patch/make-relocatable.sh
+++ b/patch/make-relocatable.sh
@@ -24,4 +24,15 @@ for module in `find . -name "*.dylib" -type f -o -name "*.so" -type f`; do
        done
     fi
 done
+for exe in `find bin Resources/Python.app/Contents/MacOS -type f -perm +111`; do
+    if [ "$(otool -L ${exe} 2>/dev/null | grep -c /Library/Frameworks/Python.framework)" != "0" ]; then
+        echo Rewrite references to Python library in ${exe}
+        install_name_tool -change /Library/Frameworks/Python.framework/Versions/${PYTHON_VER}/Python @rpath/Python.framework/Versions/${PYTHON_VER}/Python ${exe}
+        # Add an rpath pointing at the directory that contains Python.framework
+        # (one level up per path component, plus 3 for Python.framework/Versions/X.Y)
+        depth=$(( $(echo ${exe} | tr -cd '/' | wc -c) + 3 ))
+        rpath=@executable_path$(printf '/..%.0s' $(seq ${depth}))
+        install_name_tool -add_rpath ${rpath} ${exe}
+    fi
+done
 popd