diff --git a/content_moderation_notifications.module b/content_moderation_notifications.module
index f9b0806..bef4117 100644
--- a/content_moderation_notifications.module
+++ b/content_moderation_notifications.module
@@ -40,6 +40,12 @@ function content_moderation_notifications_entity_insert(EntityInterface $entity)
 function content_moderation_notifications_mail($key, &$message, $params) {
   switch ($key) {
     case 'content_moderation_notification':
+      // Add headers, specifically this should include the Bcc header.
+      if (!empty($params['headers'])) {
+        foreach ($params['headers'] as $id => $value) {
+          $message['headers'][$id] = $params['headers'][$id];
+        }
+      }
 
       $message['from'] = \Drupal::config('system.site')->get('mail');
 
diff --git a/src/Notification.php b/src/Notification.php
index af8c96c..6518a19 100644
--- a/src/Notification.php
+++ b/src/Notification.php
@@ -155,7 +155,14 @@ class Notification implements NotificationInterface {
       // Remove any duplicates.
       $data['to'] = array_unique($data['to']);
 
-      $this->mailManager->mail('content_moderation_notifications', 'content_moderation_notification', implode(',', $data['to']), $data['langcode'], $data['params'], NULL, TRUE);
+      // Force to BCC.
+      $data['params']['headers']['Bcc'] = implode(',', $data['to']);
+
+      // Displayed 'to' address.
+      // @todo Make this configurable.
+      $recipient = \Drupal::config('system.site')->get('mail');
+
+      $this->mailManager->mail('content_moderation_notifications', 'content_moderation_notification', $recipient, $data['langcode'], $data['params'], NULL, TRUE);
     }
   }
 
diff --git a/tests/src/Kernel/NotificationsTest.php b/tests/src/Kernel/NotificationsTest.php
index 54ad0d2..479b4ee 100644
--- a/tests/src/Kernel/NotificationsTest.php
+++ b/tests/src/Kernel/NotificationsTest.php
@@ -44,6 +44,9 @@ class NotificationsTest extends KernelTestBase {
     $this->installEntitySchema('user');
     $this->installConfig(['content_moderation', 'filter_test']);
 
+    // Setup site email.
+    $this->config('system.site')->set('mail', 'admin@example.com')->save();
+
     // Attach workflow to entity test.
     /** @var \Drupal\workflows\WorkflowInterface $workflow */
     $workflow = Workflow::load('editorial');
@@ -73,14 +76,18 @@ class NotificationsTest extends KernelTestBase {
     $entity = \Drupal::entityTypeManager()->getStorage('entity_test_rev')->loadUnchanged($entity->id());
     $this->assertEquals('draft', $entity->moderation_state->value);
     $entity->save();
-    $this->assertMail('to', 'foo@example.com,bar@example.com');
+    $this->assertMail('from', 'admin@example.com');
+    $this->assertMail('to', 'admin@example.com');
+    $this->assertBccRecipients('foo@example.com,bar@example.com');
     $this->assertMail('id', 'content_moderation_notifications_content_moderation_notification');
     $this->assertMail('subject', PlainTextOutput::renderFromHtml($notification->getSubject()));
     $this->assertCount(1, $this->getMails());
 
     $entity->moderation_state = 'published';
     $entity->save();
-    $this->assertMail('to', 'foo@example.com,bar@example.com');
+    $this->assertMail('from', 'admin@example.com');
+    $this->assertMail('to', 'admin@example.com');
+    $this->assertBccRecipients('foo@example.com,bar@example.com');
     $this->assertMail('id', 'content_moderation_notifications_content_moderation_notification');
     $this->assertMail('subject', PlainTextOutput::renderFromHtml($notification->getSubject()));
     $this->assertCount(2, $this->getMails());
@@ -99,10 +106,25 @@ class NotificationsTest extends KernelTestBase {
     $this->assertEquals('archived', $entity->moderation_state->value);
     $entity->moderation_state = 'published';
     $entity->save();
-    $this->assertMail('to', 'altered@example.com,foo' . $entity->id() . '@example.com');
+    $this->assertMail('from', 'admin@example.com');
+    $this->assertMail('to', 'admin@example.com');
+    $this->assertBccRecipients('altered@example.com,foo' . $entity->id() . '@example.com');
     $this->assertMail('id', 'content_moderation_notifications_content_moderation_notification');
     $this->assertMail('subject', PlainTextOutput::renderFromHtml($notification->getSubject()));
     $this->assertCount(3, $this->getMails());
   }
 
+  /**
+   * Helper method to assert the Bcc recipients.
+   *
+   * @param string $recipients
+   *   The expected recipients.
+   */
+  protected function assertBccRecipients($recipients) {
+    $mails = $this->getMails();
+    $mail = end($mails);
+    $this->assertNotEmpty($mail['headers']['Bcc']);
+    $this->assertEquals($recipients, $mail['headers']['Bcc']);
+  }
+
 }
diff --git a/tests/src/Kernel/TokenNotificationsTest.php b/tests/src/Kernel/TokenNotificationsTest.php
index 73e2bc0..c7b51b3 100644
--- a/tests/src/Kernel/TokenNotificationsTest.php
+++ b/tests/src/Kernel/TokenNotificationsTest.php
@@ -31,10 +31,14 @@ class TokenNotificationsTest extends NotificationsTest {
     parent::setUp();
 
     $this->installEntitySchema('node');
-    $this->installConfig(['filter', 'node', 'system']);
     $this->installSchema('node', ['node_access']);
+    $this->installConfig(['filter', 'node', 'system']);
+
     $this->createContentType(['type' => 'article']);
 
+    // Setup site email.
+    $this->config('system.site')->set('mail', 'admin@example.com')->save();
+
     /** @var \Drupal\workflows\WorkflowInterface $workflow */
     $workflow = Workflow::load('editorial');
     $workflow->getTypePlugin()->addEntityTypeAndBundle('node', 'article');
@@ -61,7 +65,8 @@ class TokenNotificationsTest extends NotificationsTest {
 
     $entity = $this->createNode(['type' => 'article']);
 
-    $this->assertMail('to', 'foo@example.com,bar@example.com');
+    $this->assertMail('to', 'admin@example.com');
+    $this->assertBccRecipients('foo@example.com,bar@example.com');
     $this->assertMail('id', 'content_moderation_notifications_content_moderation_notification');
     $this->assertMail('subject', PlainTextOutput::renderFromHtml($notification->getSubject()));
     $this->assertCount(1, $this->getMails());