diff --git a/CHANGES.md b/CHANGES.md
index 446977bbf8e..b17a2043a98 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -118,6 +118,9 @@ Unreleased
 - Fix regression where Merlin was unable to handle filenames with uppercase
   letters under Windows. (#7577, @nojb)
 
+- On nix+macos, pass `-f` to the codesign hook to avoid errors when the binary
+  is already signed (#7183, fixes #6265, @greedy)
+
 3.7.1 (2023-04-04)
 ------------------
 
diff --git a/src/dune_rules/artifact_substitution.ml b/src/dune_rules/artifact_substitution.ml
index d7bac734774..cacaf39cb74 100644
--- a/src/dune_rules/artifact_substitution.ml
+++ b/src/dune_rules/artifact_substitution.ml
@@ -52,7 +52,14 @@ type conf =
   }
 
 let mac_codesign_hook ~codesign path =
-  Process.run ~display:Quiet Strict codesign [ "-s"; "-"; Path.to_string path ]
+  let stdout_to =
+    Process.Io.make_stdout Execution_parameters.Action_output_on_success.Swallow
+  in
+  let stderr_to =
+    Process.Io.make_stderr Execution_parameters.Action_output_on_success.Swallow
+  in
+  Process.run ~stdout_to ~stderr_to ~display:Quiet Strict codesign
+    [ "-f"; "-s"; "-"; Path.to_string path ]
 
 let sign_hook_of_context (context : Context.t) =
   let config = context.ocaml_config in