diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index e22c36e..0f52b10 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -45,11 +45,12 @@ jobs:
         # which keeps the NuGet package cache + project.assets.json + assembly
         # resolution consistent (avoids NETSDK1064 from a mismatch between a
         # standalone `nuget restore` and the later build).
-        # SignManifests=false disables the project's compile-time ClickOnce
-        # manifest signing (it references VS's auto-generated temporary key
-        # which doesn't exist on the runner). The release manifests are signed
-        # later with the real code-signing cert via mage in publish-clickonce.
-        run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:SignManifests=false /m
+        # VSTO mandates SignManifests=true (the build aborts otherwise). The
+        # project's hardcoded ManifestCertificateThumbprint points to VS's
+        # auto-generated temporary key which doesn't exist on the runner, so
+        # override it with the real Marcus-Law cert that lives in
+        # LocalMachine\My (migrated there by 2-install-windows-runner.ps1).
+        run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:ManifestCertificateThumbprint=${{ secrets.CODESIGN_THUMBPRINT }} /p:ManifestKeyFile= /m
 
       - name: Test
         run: dotnet test src/OutlookAddin.Tests/OutlookAddin.Tests.csproj --configuration Release --no-build --logger "trx;LogFileName=test-results.trx"
@@ -138,11 +139,12 @@ jobs:
           Write-Host "Cert imported."
 
       - name: Build Release (restore + compile)
-        # SignManifests=false disables the project's compile-time ClickOnce
-        # manifest signing (it references VS's auto-generated temporary key
-        # which doesn't exist on the runner). The release manifests are signed
-        # later with the real code-signing cert via mage in publish-clickonce.
-        run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:SignManifests=false /m
+        # VSTO mandates SignManifests=true (the build aborts otherwise). The
+        # project's hardcoded ManifestCertificateThumbprint points to VS's
+        # auto-generated temporary key which doesn't exist on the runner, so
+        # override it with the real Marcus-Law cert that lives in
+        # LocalMachine\My (migrated there by 2-install-windows-runner.ps1).
+        run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:ManifestCertificateThumbprint=${{ secrets.CODESIGN_THUMBPRINT }} /p:ManifestKeyFile= /m
 
       # Code signing -- cert in LocalMachine\My (or CurrentUser\My); signtool
       # picks it by thumbprint, the service runs as LocalSystem so the runtime