diff --git a/.gitmodules b/.gitmodules
index 69f3e13..52ee06e 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,6 +1,6 @@
 [submodule "Dependencies/ldid"]
 	path = Dependencies/ldid
-	url = https://github.com/rileytestut/ldid.git
+	url = https://github.com/SideStore/ldid.git
 [submodule "Dependencies/OpenSSL"]
 	path = Dependencies/OpenSSL
 	url = https://github.com/krzyzanowskim/OpenSSL
diff --git a/Sources/ALTSigner.swift b/Sources/ALTSigner.swift
index b494d66..04fc7fe 100644
--- a/Sources/ALTSigner.swift
+++ b/Sources/ALTSigner.swift
@@ -103,18 +103,33 @@ private extension ALTSigner {
             verboseLog("[AltSign] Writing mobileprovision to: \(profileURL.path)")
             try profile.data.write(to: profileURL)
 
+            verboseLog("[AltSign] Original profile entitlements: \(profile.entitlements)")
+            let applicationEntitlements = app.entitlements
             var filtered = profile.entitlements
-            verboseLog("[AltSign] Original profile entitlements: \(filtered)")
 
             for (key, _) in profile.entitlements {
-                if app.entitlements[key] == nil {
-
-                    if key == ALTEntitlementApplicationIdentifier ||
-                       key == ALTEntitlementTeamIdentifier ||
-                       key == ALTEntitlementGetTaskAllow {
-                        continue
+                if let applicationValue = applicationEntitlements[key] {
+                    if key == ALTEntitlementKeychainAccessGroups {
+                        guard let groups = applicationValue as? [String] else {
+                            verboseLog("The app's keychain-access-groups entitlement is not an array of strings.")
+                            continue
+                        }
+                        
+                        filtered[key] = try groups.map { group in
+                            guard let separator = group.firstIndex(of: ".") else {
+                                throw NSError(
+                                    domain: AltSignErrorDomain,
+                                    code: ALTError.invalidApp.rawValue,
+                                    userInfo: [NSLocalizedFailureReasonErrorKey: "The keychain access group '\(group)' does not contain a Team ID prefix."]
+                                )
+                            }
+                            
+                            return profile.teamIdentifier + group[separator...]
+                        }
                     }
-
+                } else if key != ALTEntitlementApplicationIdentifier &&
+                            key != ALTEntitlementTeamIdentifier &&
+                            key != ALTEntitlementGetTaskAllow {
                     filtered.removeValue(forKey: key)
                 }
             }