diff --git a/env_installer/sign-osx-64.txt b/env_installer/sign-osx-64.txt
index 3351da67..4324f59b 100644
--- a/env_installer/sign-osx-64.txt
+++ b/env_installer/sign-osx-64.txt
@@ -520,3 +520,14 @@ libexec/lzo/examples/lzopack
 libexec/lzo/examples/lzotest
 libexec/lzo/examples/simple
 libexec/lzo/examples/testmini
+sbin/gss-server
+sbin/kadmin.local
+sbin/kadmind
+sbin/kdb5_util
+sbin/kprop
+sbin/kpropd
+sbin/kproplog
+sbin/krb5kdc
+sbin/sim_server
+sbin/sserver
+sbin/uuserver
diff --git a/env_installer/sign-osx-arm64.txt b/env_installer/sign-osx-arm64.txt
index c7e30a06..b3fa1251 100644
--- a/env_installer/sign-osx-arm64.txt
+++ b/env_installer/sign-osx-arm64.txt
@@ -512,3 +512,14 @@ libexec/lzo/examples/lzopack
 libexec/lzo/examples/lzotest
 libexec/lzo/examples/simple
 libexec/lzo/examples/testmini
+sbin/gss-server
+sbin/kadmin.local
+sbin/kadmind
+sbin/kdb5_util
+sbin/kprop
+sbin/kpropd
+sbin/kproplog
+sbin/krb5kdc
+sbin/sim_server
+sbin/sserver
+sbin/uuserver
diff --git a/scripts/buildutil.js b/scripts/buildutil.js
index adf8d67a..49a80483 100644
--- a/scripts/buildutil.js
+++ b/scripts/buildutil.js
@@ -94,13 +94,15 @@ if (cli.flags.updateBinarySignList) {
   const { isBinary } = require('istextorbinary');
   const envInstallerDir = path.resolve('env_installer', 'jlab_server');
   const envBinDir = path.join(envInstallerDir, 'bin');
-  const libExecDir = path.join(envInstallerDir, 'libexec');
+  const envSbinDir = path.join(envInstallerDir, 'sbin');
+  const envLibexecDir = path.join(envInstallerDir, 'libexec');
 
   const needsSigning = filePath => {
-    // only consider bin & libexec directory, and .so, .dylib files in other directories
+    // consider bin, libexec, sbin directories, and .so, .dylib files in other directories
     if (
       filePath.startsWith(envBinDir) ||
-      filePath.startsWith(libExecDir) ||
+      filePath.startsWith(envLibexecDir) ||
+      filePath.startsWith(envSbinDir) ||
       filePath.endsWith('.so') ||
       filePath.endsWith('.dylib')
     ) {