diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 9fc5591..fc6342c 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -40,59 +40,77 @@ jobs:
           Write-Host "Using MSBuild from $msbuildDir"
           Add-Content -Path $env:GITHUB_PATH -Value $msbuildDir
 
-      - name: Import code-signing cert into CurrentUser\My
-        # The VSTO ResolveKeySource target reads ManifestCertificateThumbprint
-        # straight from the csproj XML and looks for it under Cert:\CurrentUser\My
-        # (not LocalMachine\My). Import the real Marcus-Law cert there.
+      - name: Prepare + Build (single-step with full transcript)
         shell: powershell
         env:
           PFX_B64: ${{ secrets.CODESIGN_CERT_PFX_BASE64 }}
           PFX_PWD: ${{ secrets.CODESIGN_CERT_PASSWORD }}
           THUMB:   ${{ secrets.CODESIGN_THUMBPRINT }}
         run: |
-          $existing = Get-ChildItem Cert:\CurrentUser\My -ErrorAction SilentlyContinue |
-              Where-Object { $_.Thumbprint -eq $env:THUMB }
-          if ($existing) { Write-Host "Cert already in CurrentUser\My."; return }
-          $pfxBytes = [Convert]::FromBase64String($env:PFX_B64)
-          $tmp = Join-Path $env:TEMP "codesign-$([Guid]::NewGuid()).pfx"
-          [IO.File]::WriteAllBytes($tmp, $pfxBytes)
-          $pwd = ConvertTo-SecureString -String $env:PFX_PWD -Force -AsPlainText
-          Import-PfxCertificate -FilePath $tmp -CertStoreLocation Cert:\CurrentUser\My -Password $pwd | Out-Null
-          Remove-Item -Force $tmp
-          Write-Host "Cert imported into CurrentUser\My."
+          $ErrorActionPreference = 'Continue'
+          Start-Transcript -Path build.console.log -IncludeInvocationHeader -Force
 
-      - name: Patch csproj to use real cert thumbprint
-        # VS's compile-time manifest signing reads the thumbprint from the
-        # csproj XML (not from /p: overrides), so we rewrite it in place to
-        # point at our Marcus-Law cert.
-        shell: powershell
-        env:
-          THUMB: ${{ secrets.CODESIGN_THUMBPRINT }}
-        run: |
-          $csproj = 'src/OutlookAddin/OutlookAddin.csproj'
-          $orig   = '2399E9BF73820F3B1FC744BCBFA7F82D536E3256'
-          $content = Get-Content $csproj -Raw
-          $patched = $content -replace [regex]::Escape($orig), $env:THUMB
-          if ($patched -eq $content) { Write-Warning "Thumbprint $orig not present in csproj." }
-          else { Set-Content -Path $csproj -Value $patched -NoNewline; Write-Host "Patched: $orig -> $env:THUMB" }
+          try {
+              # --- 1. Cert into CurrentUser\My (VSTO target needs it there) ---
+              Write-Host "=== STEP 1: Import cert into CurrentUser\My ==="
+              $existing = Get-ChildItem Cert:\CurrentUser\My -ErrorAction SilentlyContinue |
+                  Where-Object { $_.Thumbprint -eq $env:THUMB }
+              if ($existing) {
+                  Write-Host "Cert $env:THUMB already in CurrentUser\My."
+              } else {
+                  $pfxBytes = [Convert]::FromBase64String($env:PFX_B64)
+                  $tmp = Join-Path $env:TEMP "codesign-$([Guid]::NewGuid()).pfx"
+                  [IO.File]::WriteAllBytes($tmp, $pfxBytes)
+                  $pwd = ConvertTo-SecureString -String $env:PFX_PWD -Force -AsPlainText
+                  Import-PfxCertificate -FilePath $tmp -CertStoreLocation Cert:\CurrentUser\My -Password $pwd -ErrorAction Stop | Out-Null
+                  Remove-Item -Force $tmp
+                  Write-Host "Imported into CurrentUser\My."
+              }
 
-      - name: Build (restore + compile)
-        shell: powershell
-        run: |
-          $msbuildArgs = @(
-            'OutlookAddin.sln',
-            '/restore',
-            '/t:Build',
-            '/p:Configuration=Release',
-            '/p:Platform="Any CPU"',
-            '/m',
-            '/flp:logfile=build.log;verbosity=detailed',
-            '/flp1:logfile=build-errors.log;errorsonly',
-            '/flp2:logfile=build-warnings.log;warningsonly'
-          )
-          & msbuild @msbuildArgs 2>&1 | Tee-Object -FilePath build.console.log
-          $code = $LASTEXITCODE
-          Write-Host "msbuild exit code: $code"
+              # Verify what's in the store now
+              Write-Host "Certs in CurrentUser\My:"
+              Get-ChildItem Cert:\CurrentUser\My | ForEach-Object {
+                  Write-Host "  $($_.Thumbprint) $($_.Subject)"
+              }
+
+              # --- 2. Patch csproj ---
+              Write-Host "=== STEP 2: Patch csproj ==="
+              $csproj = 'src/OutlookAddin/OutlookAddin.csproj'
+              $orig   = '2399E9BF73820F3B1FC744BCBFA7F82D536E3256'
+              $content = Get-Content $csproj -Raw
+              if ($content -match [regex]::Escape($orig)) {
+                  $patched = $content -replace [regex]::Escape($orig), $env:THUMB
+                  Set-Content -Path $csproj -Value $patched -NoNewline
+                  Write-Host "Patched csproj: $orig -> $env:THUMB"
+              } else {
+                  Write-Host "Thumbprint $orig already replaced (or not present)."
+              }
+              # Verify
+              Write-Host "Resulting ManifestCertificateThumbprint:"
+              (Get-Content $csproj | Select-String 'ManifestCertificateThumbprint') -join "`n" | Write-Host
+
+              # --- 3. Build ---
+              Write-Host "=== STEP 3: msbuild /restore /t:Build ==="
+              $msbuildArgs = @(
+                  'OutlookAddin.sln',
+                  '/restore',
+                  '/t:Build',
+                  '/p:Configuration=Release',
+                  '/p:Platform="Any CPU"',
+                  '/m',
+                  '/flp:logfile=build.log;verbosity=detailed',
+                  '/flp1:logfile=build-errors.log;errorsonly'
+              )
+              & msbuild @msbuildArgs
+              $code = $LASTEXITCODE
+              Write-Host "msbuild exit code: $code"
+          } catch {
+              Write-Host "FATAL: $($_.Exception.Message)"
+              Write-Host $_.ScriptStackTrace
+              $code = 1
+          } finally {
+              Stop-Transcript
+          }
           if ($code -ne 0) { exit $code }
 
       - name: Upload build logs
@@ -101,10 +119,10 @@ jobs:
         with:
           name: build-logs-run${{ github.run_id }}
           path: |
+            build.console.log
             build.log
             build-errors.log
-            build-warnings.log
-            build.console.log
+            src/OutlookAddin/OutlookAddin.csproj
           retention-days: 7
           if-no-files-found: warn