diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index df2cdaefa..8b6cc8269 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -510,6 +510,21 @@ jobs:
           APP_PATH="${{ steps.locate-app.outputs.app_path }}"
           ENTITLEMENTS="app/src-tauri/entitlements.sidecar.plist"
 
+          # Ensure signing identity is available — re-import cert into a keychain
+          # in case tauri-action's keychain was cleaned up
+          KEYCHAIN="resign-$$.keychain-db"
+          KEYCHAIN_PW="$(openssl rand -base64 24)"
+          CERT_FILE="$(mktemp /tmp/cert-XXXXXX.p12)"
+          echo "$APPLE_CERTIFICATE_BASE64" | base64 --decode > "$CERT_FILE"
+          security create-keychain -p "$KEYCHAIN_PW" "$KEYCHAIN"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN"
+          security unlock-keychain -p "$KEYCHAIN_PW" "$KEYCHAIN"
+          security import "$CERT_FILE" -k "$KEYCHAIN" -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security
+          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PW" "$KEYCHAIN"
+          security list-keychains -d user -s "$KEYCHAIN" $(security list-keychains -d user | tr -d '"')
+          rm -f "$CERT_FILE"
+          echo "Signing identity imported into $KEYCHAIN"
+
           echo "=== Re-signing binaries inside $APP_PATH with hardened runtime ==="
 
           # Determine main executable name from Info.plist