--- a/taskcluster/ci/config.yml
+++ b/taskcluster/ci/config.yml
@@ -408,12 +408,12 @@ mac-notarization:
             nightly.*: mac_notarize
             beta.*: mac_notarize
             esr.*: mac_notarize
             release.*: mac_notarize
             default: mac_sign_and_pkg
     mac-entitlements:
         by-platform:
             macosx64.*:
-                by-project:
-                    mozilla-(central|beta|release): security/mac/hardenedruntime/production.entitlements.xml
+                by-release-level:
+                    production: security/mac/hardenedruntime/production.entitlements.xml
                     default: security/mac/hardenedruntime/developer.entitlements.xml
             default: ''

--- a/taskcluster/taskgraph/config.py
+++ b/taskcluster/taskgraph/config.py
@@ -88,17 +88,17 @@ graph_config_schema = Schema({
             }
         },
     },
     Required('mac-notarization'): {
         Required('mac-behavior'):
             optionally_keyed_by('platform', 'release-type',
                                 Any('mac_notarize', 'mac_pkg', 'mac_sign', 'mac_sign_and_pkg')),
         Required('mac-entitlements'):
-            optionally_keyed_by('platform', 'project', text_type),
+            optionally_keyed_by('platform', 'release-level', text_type),
     },
 })
 
 
 @attr.s(frozen=True, cmp=False)
 class GraphConfig(object):
     _config = attr.ib()
     root_dir = attr.ib()

--- a/taskcluster/taskgraph/transforms/signing.py
+++ b/taskcluster/taskgraph/transforms/signing.py
@@ -76,17 +76,17 @@ transforms.add_validate(signing_descript
 @transforms.add
 def add_entitlements_link(config, jobs):
     for job in jobs:
         entitlements_path = evaluate_keyed_by(
             config.graph_config['mac-notarization']['mac-entitlements'],
             "mac entitlements",
             {
                 'platform': job['primary-dependency'].attributes.get('build_platform'),
-                'project': config.params['project'],
+                'release-level': config.params.release_level(),
             },
         )
         if entitlements_path:
             job['entitlements-url'] = config.params.file_url(
                 entitlements_path, endpoint="raw-file"
             )
         yield job