Turns out it is now a requirement to notarize our internal apps. We notarized ours and rebuilt it, and now it works! But that was still a bit of a hassle.