diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 3c2c45e..295856a 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -291,11 +291,18 @@ jobs:
               New-Item -ItemType Directory -Force -Path $appFilesDir | Out-Null
               Copy-Item -Recurse -Force "$appBin/*" $appFilesDir
 
+              # Write the PFX to disk so mage can sign via -CertFile (more reliable
+              # than -CertHash under LocalSystem).
+              $signPfx = Join-Path $env:TEMP "sign-$([Guid]::NewGuid()).pfx"
+              [IO.File]::WriteAllBytes($signPfx, [Convert]::FromBase64String($env:PFX_B64))
+
               & "$env:MAGE" -New Application -ToFile "$appFilesDir/MarcusLaw.OutlookAddin.dll.manifest" `
                   -Name "Marcus-Law OutlookAddin" -Version $version -FromDirectory $appFilesDir -TrustLevel FullTrust
-              if ($LASTEXITCODE -ne 0) { throw "mage -New failed" }
+              if ($LASTEXITCODE -ne 0) { throw "mage -New Application failed" }
 
-              & "$env:MAGE" -Sign "$appFilesDir/MarcusLaw.OutlookAddin.dll.manifest" -CertHash $thumb -TimeStampUri http://timestamp.digicert.com
+              & "$env:MAGE" -Sign "$appFilesDir/MarcusLaw.OutlookAddin.dll.manifest" `
+                  -CertFile $signPfx -Password $env:PFX_PWD `
+                  -TimeStampUri http://timestamp.digicert.com
               if ($LASTEXITCODE -ne 0) { throw "mage -Sign app manifest failed" }
 
               # Create the deployment manifest (.vsto) directly via -New Deployment.
@@ -311,8 +318,11 @@ jobs:
                   -Install     true
               if ($LASTEXITCODE -ne 0) { throw "mage -New Deployment failed" }
 
-              & "$env:MAGE" -Sign "$publishDir/OutlookAddin.vsto" -CertHash $thumb -TimeStampUri http://timestamp.digicert.com
+              & "$env:MAGE" -Sign "$publishDir/OutlookAddin.vsto" `
+                  -CertFile $signPfx -Password $env:PFX_PWD `
+                  -TimeStampUri http://timestamp.digicert.com
               if ($LASTEXITCODE -ne 0) { throw "mage -Sign deployment manifest failed" }
+              Remove-Item -Force $signPfx
 
               Get-ChildItem -Recurse -File "$appFilesDir" |
                   ? { $_.Extension -notin '.manifest','.deploy' } |