diff --git a/electron/macosDistributionPolicy.test.mjs b/electron/macosDistributionPolicy.test.mjs
index d6f56b9c..e287c014 100644
--- a/electron/macosDistributionPolicy.test.mjs
+++ b/electron/macosDistributionPolicy.test.mjs
@@ -72,6 +72,17 @@ describe("macOS distribution entitlement policy", () => {
 			"distribution build must not enable com.apple.security.get-task-allow",
 		]);
 	});
+
+	it("rejects unreviewed root runtime exceptions", () => {
+		expect(
+			collectEntitlementErrors({
+				...validEntitlements,
+				"com.apple.security.cs.allow-dyld-environment-variables": true,
+			}),
+		).toEqual([
+			"unexpected root application entitlement: com.apple.security.cs.allow-dyld-environment-variables",
+		]);
+	});
 });
 
 describe("macOS distribution architecture policy", () => {
diff --git a/scripts/macos-distribution-policy.mjs b/scripts/macos-distribution-policy.mjs
index c35eda35..5a6a4db9 100644
--- a/scripts/macos-distribution-policy.mjs
+++ b/scripts/macos-distribution-policy.mjs
@@ -8,6 +8,8 @@ export const REQUIRED_MACOS_ENTITLEMENTS = Object.freeze([
 	"com.apple.security.device.camera",
 ]);
 
+const ALLOWED_MACOS_ENTITLEMENTS = new Set(REQUIRED_MACOS_ENTITLEMENTS);
+
 function readCodeSignValue(details, key) {
 	const prefix = `${key}=`;
 	return details
@@ -66,8 +68,20 @@ export function collectEntitlementErrors(entitlements) {
 		}
 	}
 
-	if (entitlements["com.apple.security.get-task-allow"] === true) {
-		errors.push("distribution build must not enable com.apple.security.get-task-allow");
+	for (const entitlement of Object.keys(entitlements).sort()) {
+		if (ALLOWED_MACOS_ENTITLEMENTS.has(entitlement)) {
+			continue;
+		}
+
+		if (
+			entitlement === "com.apple.security.get-task-allow" &&
+			entitlements[entitlement] === true
+		) {
+			errors.push("distribution build must not enable com.apple.security.get-task-allow");
+			continue;
+		}
+
+		errors.push(`unexpected root application entitlement: ${entitlement}`);
 	}
 
 	return errors;