diff --git a/scripts/build_go.sh b/scripts/build_go.sh
index 8dd4839371..91fc3a1e4b 100755
--- a/scripts/build_go.sh
+++ b/scripts/build_go.sh
@@ -142,6 +142,25 @@ if [[ "$agpl" == 1 ]]; then
 	# a flag to control AGPL vs. enterprise behavior.
 	ldflags+=(-X "'github.com/coder/coder/v2/buildinfo.agpl=true'")
 fi
+cgo=0
+if [[ "$dylib" == 1 ]]; then
+	if [[ "$os" != "darwin" ]]; then
+		error "dylib builds are not supported on $os"
+	fi
+	cgo=1
+	build_args+=("-buildmode=c-shared")
+	SDKROOT="$(xcrun --sdk macosx --show-sdk-path)"
+	export SDKROOT
+	bin_ident="com.coder.Coder-Desktop.VPN.dylib"
+
+	plist_file=$(mktemp)
+	trap 'rm -f "$plist_file"' EXIT
+	# CFBundleShortVersionString must be in the format /[0-9]+.[0-9]+.[0-9]+/
+	# CFBundleVersion can be in any format
+	BUNDLE_IDENTIFIER="$bin_ident" VERSION_STRING="$version" SHORT_VERSION_STRING=$(echo "$version" | grep -oE '^[0-9]+\.[0-9]+\.[0-9]+') \
+		execrelative envsubst <"$(realpath ./vpn/dylib/info.plist.tmpl)" >"$plist_file"
+	ldflags+=("-extldflags '-sectcreate __TEXT __info_plist $plist_file'")
+fi
 build_args+=(-ldflags "${ldflags[*]}")
 
 # Disable optimizations if building a binary for debuggers.
@@ -175,18 +194,8 @@ cmd_path="./enterprise/cmd/coder"
 if [[ "$agpl" == 1 ]]; then
 	cmd_path="./cmd/coder"
 fi
-
-cgo=0
 if [[ "$dylib" == 1 ]]; then
-	if [[ "$os" != "darwin" ]]; then
-		error "dylib builds are not supported on $os"
-	fi
-	cgo=1
 	cmd_path="./vpn/dylib/lib.go"
-	build_args+=("-buildmode=c-shared")
-	SDKROOT="$(xcrun --sdk macosx --show-sdk-path)"
-	export SDKROOT
-	bin_ident="com.coder.vpn"
 fi
 
 goexp=""
diff --git a/scripts/sign_darwin.sh b/scripts/sign_darwin.sh
index b1d010e5e3..dce1499f33 100755
--- a/scripts/sign_darwin.sh
+++ b/scripts/sign_darwin.sh
@@ -9,7 +9,7 @@
 # certificate.
 #
 # For the Coder CLI, the binary_identifier should be "com.coder.cli".
-# For the CoderVPN `.dylib`, the binary_identifier should be "com.coder.vpn".
+# For the CoderVPN `.dylib`, the binary_identifier should be "com.coder.Coder-Desktop.VPN.dylib".
 #
 # You can check if a binary is signed by running the following command on a Mac:
 #   codesign -dvv path/to/binary
diff --git a/vpn/dylib/info.plist.tmpl b/vpn/dylib/info.plist.tmpl
new file mode 100644
index 0000000000..caf9cfa575
--- /dev/null
+++ b/vpn/dylib/info.plist.tmpl
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>CFBundleName</key>
+    <string>CoderVPN</string>
+    <key>CFBundleIdentifier</key>
+    <string>${BUNDLE_IDENTIFIER}</string>
+    <key>CFBundleVersion</key>
+    <string>${VERSION_STRING}</string>
+    <key>CFBundleShortVersionString</key>
+    <string>${SHORT_VERSION_STRING}</string>
+</dict>
+</plist>