diff --git a/server/channels/app/notification_push.go b/server/channels/app/notification_push.go
index da4220dcea..727c403d72 100644
--- a/server/channels/app/notification_push.go
+++ b/server/channels/app/notification_push.go
@@ -14,6 +14,7 @@ import (
 	"strings"
 	"sync"
 
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/mattermost/mattermost/server/public/plugin"
 
 	"github.com/mattermost/mattermost/server/public/model"
@@ -25,6 +26,12 @@ import (
 
 type notificationType string
 
+type pushJWTClaims struct {
+	AckId    string `json:"ack_id"`
+	DeviceId string `json:"device_id"`
+	jwt.RegisteredClaims
+}
+
 const (
 	notificationTypeClear       notificationType = "clear"
 	notificationTypeMessage     notificationType = "message"
@@ -108,17 +115,17 @@ func (a *App) sendPushNotificationToAllSessions(rctx request.CTX, msg *model.Pus
 		return nil
 	}
 
-	sessions, err := a.getMobileAppSessions(userID)
-	if err != nil {
+	sessions, appErr := a.getMobileAppSessions(userID)
+	if appErr != nil {
 		a.CountNotificationReason(model.NotificationStatusError, model.NotificationTypePush, model.NotificationReasonFetchError)
 		a.NotificationsLog().Error("Failed to send mobile app sessions",
 			mlog.String("type", model.NotificationTypePush),
 			mlog.String("status", model.NotificationStatusError),
 			mlog.String("reason", model.NotificationReasonFetchError),
 			mlog.String("user_id", userID),
-			mlog.Err(err),
+			mlog.Err(appErr),
 		)
-		return err
+		return appErr
 	}
 
 	if msg == nil {
@@ -156,8 +163,26 @@ func (a *App) sendPushNotificationToAllSessions(rctx request.CTX, msg *model.Pus
 		tmpMessage := msg.DeepCopy()
 		tmpMessage.SetDeviceIdAndPlatform(session.DeviceId)
 		tmpMessage.AckId = model.NewId()
+		signature, err := jwt.NewWithClaims(jwt.SigningMethodES256, pushJWTClaims{
+			AckId:    tmpMessage.AckId,
+			DeviceId: tmpMessage.DeviceId,
+		}).SignedString(a.AsymmetricSigningKey())
 
-		err := a.sendToPushProxy(tmpMessage, session)
+		if err != nil {
+			a.NotificationsLog().Error("Notification error",
+				mlog.String("ackId", tmpMessage.AckId),
+				mlog.String("type", tmpMessage.Type),
+				mlog.String("userId", session.UserId),
+				mlog.String("postId", tmpMessage.PostId),
+				mlog.String("channelId", tmpMessage.ChannelId),
+				mlog.String("deviceId", tmpMessage.DeviceId),
+				mlog.String("status", err.Error()),
+			)
+			continue
+		}
+		tmpMessage.Signature = signature
+
+		err = a.sendToPushProxy(tmpMessage, session)
 		if err != nil {
 			a.CountNotificationReason(model.NotificationStatusError, model.NotificationTypePush, model.NotificationReasonPushProxySendError)
 			a.NotificationsLog().Error("Failed to send to push proxy",
diff --git a/server/public/model/push_notification.go b/server/public/model/push_notification.go
index 4ee82b73d8..31823a0f46 100644
--- a/server/public/model/push_notification.go
+++ b/server/public/model/push_notification.go
@@ -77,6 +77,7 @@ type PushNotification struct {
 	IsIdLoaded       bool        `json:"is_id_loaded"`
 	PostType         string      `json:"-"`
 	ChannelType      ChannelType `json:"-"`
+	Signature        string      `json:"signature"`
 }
 
 func (pn *PushNotification) DeepCopy() *PushNotification {