diff --git a/tools/bots/test_matrix.json b/tools/bots/test_matrix.json
index be54229c3d4..dd793ce2235 100644
--- a/tools/bots/test_matrix.json
+++ b/tools/bots/test_matrix.json
@@ -1059,7 +1059,6 @@
           "name": "build dart",
           "script": "tools/build.py",
           "arguments": [
-            "--codesigning-identity=-",
             "--include-experimental-vm-service",
             "runtime"
           ]
@@ -1090,7 +1089,6 @@
           "name": "build dart",
           "script": "tools/build.py",
           "arguments": [
-            "--codesigning-identity=-",
             "--include-experimental-vm-service",
             "runtime"
           ]
@@ -1099,7 +1097,6 @@
           "name": "build iOS shared library",
           "script": "tools/build.py",
           "arguments": [
-            "--codesigning-identity=-",
             "--os=ios",
             "runtime:dart_jit_library"
           ]
@@ -1140,7 +1137,6 @@
           "name": "build dart",
           "script": "tools/build.py",
           "arguments": [
-            "--codesigning-identity=-",
             "runtime"
           ]
         },
@@ -1171,7 +1167,6 @@
           "name": "build dart",
           "script": "tools/build.py",
           "arguments": [
-            "--codesigning-identity=-",
             "--include-experimental-vm-service",
             "runtime",
             "dartaotruntime"
@@ -1213,7 +1208,6 @@
           "name": "build dart",
           "script": "tools/build.py",
           "arguments": [
-            "--codesigning-identity=-",
             "runtime",
             "dartaotruntime"
           ]
@@ -1328,7 +1322,6 @@
           "script": "tools/build.py",
           "arguments": [
             "--dart-dynamic-modules",
-            "--codesigning-identity=-",
             "runtime",
             "utils/dart2bytecode",
             "utils/modular_aot_compiler"
@@ -1485,7 +1478,6 @@
           "script": "tools/build.py",
           "arguments": [
             "--dart-dynamic-modules",
-            "--codesigning-identity=-",
             "runtime",
             "runtime_precompiled",
             "utils/gen_kernel"
@@ -3145,7 +3137,6 @@
           "name": "build dart",
           "script": "tools/build.py",
           "arguments": [
-            "--codesigning-identity=-",
             "create_sdk",
             "dartanalyzer",
             "ddc_stable_test",
diff --git a/tools/gn.py b/tools/gn.py
index b2d1bec4538..bc6e217d817 100755
--- a/tools/gn.py
+++ b/tools/gn.py
@@ -322,8 +322,16 @@ def ToGnArgs(args, mode, arch, target_os, sanitizer, verify_sdk_hash,
     gn_args['verify_sdk_hash'] = verify_sdk_hash
     gn_args['dart_version_git_info'] = git_version
 
-    if args.codesigning_identity != '':
+    if args.codesigning_identity:
         gn_args['codesigning_identity'] = args.codesigning_identity
+    elif sanitizer == 'none':
+        # Enable ad-hoc code signing by default, but not for sanitizer builds.
+        # The santizers use dynamic linking on Mac, and fail library
+        # validation under the hardened runtime. We'd need to either disable
+        # the hardened runtime, add the disable-library-validation entitlement
+        # to every executable, or get a proper signing identity with a team set
+        # and also sign the sanitizer libraries.
+        gn_args['codesigning_identity'] = '-'
 
     return gn_args
 
@@ -552,7 +560,6 @@ def AddCommonGnOptionArgs(parser):
                         action='store_true')
     parser.add_argument('--codesigning-identity',
                         help='Sign executables using the given identity.',
-                        default='',
                         type=str)
     parser.add_argument(
         '--include-experimental-vm-service',