diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index c0d9c95..0363d57 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -19,6 +19,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Add MSBuild to PATH
+        uses: microsoft/setup-msbuild@v2
+
+      - name: Setup NuGet
+        uses: nuget/setup-nuget@v2
+
       - name: Restore NuGet
         run: nuget restore OutlookAddin.sln
 
@@ -39,13 +45,37 @@ jobs:
     needs: build
     runs-on: windows-latest
     if: startsWith(github.ref, 'refs/tags/v')
-    env:
-      MAGE:     'C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\mage.exe'
-      SIGNTOOL: 'C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64\signtool.exe'
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Add MSBuild to PATH
+        uses: microsoft/setup-msbuild@v2
+
+      - name: Setup NuGet
+        uses: nuget/setup-nuget@v2
+
+      - name: Resolve mage.exe + signtool.exe paths
+        id: tools
+        shell: pwsh
+        run: |
+          # mage.exe lives under .NET 4.8 Developer Pack. Find any installed copy.
+          $mage = Get-ChildItem 'C:\Program Files (x86)\Microsoft SDKs\Windows' -Recurse -Filter mage.exe -ErrorAction SilentlyContinue |
+              Sort-Object FullName -Descending | Select-Object -First 1
+          if (-not $mage) { throw "mage.exe not found" }
+
+          # signtool.exe lives under Windows SDK. Pick the highest-version x64 copy.
+          $signtool = Get-ChildItem 'C:\Program Files (x86)\Windows Kits\10\bin' -Recurse -Filter signtool.exe -ErrorAction SilentlyContinue |
+              Where-Object { $_.FullName -like '*\x64\*' } |
+              Sort-Object { [version](Split-Path -Leaf (Split-Path -Parent (Split-Path -Parent $_.FullName))) } -Descending |
+              Select-Object -First 1
+          if (-not $signtool) { throw "signtool.exe not found" }
+
+          Write-Host "MAGE:     $($mage.FullName)"
+          Write-Host "SIGNTOOL: $($signtool.FullName)"
+          "MAGE=$($mage.FullName)"         | Out-File -Append $env:GITHUB_ENV
+          "SIGNTOOL=$($signtool.FullName)" | Out-File -Append $env:GITHUB_ENV
+
       - name: Compute version from tag
         id: ver
         shell: pwsh