diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index a53e4dd..9c8a4cf 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -224,6 +224,20 @@ jobs:
           try {
               $thumb = $env:THUMB
 
+              Write-Host "=== STEP 0: resolve mage.exe + signtool.exe ==="
+              $mage = Get-ChildItem 'C:\Program Files (x86)\Microsoft SDKs\Windows' -Recurse -Filter mage.exe -ErrorAction SilentlyContinue |
+                  Sort-Object FullName -Descending | Select-Object -First 1
+              if (-not $mage) { throw "mage.exe not found" }
+              $env:MAGE = $mage.FullName
+              Write-Host "  MAGE: $($env:MAGE)"
+              $signtool = Get-ChildItem 'C:\Program Files (x86)\Windows Kits\10\bin' -Recurse -Filter signtool.exe -ErrorAction SilentlyContinue |
+                  Where-Object { $_.FullName -like '*\x64\*' } |
+                  Sort-Object { [version](Split-Path -Leaf (Split-Path -Parent (Split-Path -Parent $_.FullName))) } -Descending |
+                  Select-Object -First 1
+              if (-not $signtool) { throw "signtool.exe not found" }
+              $env:SIGNTOOL = $signtool.FullName
+              Write-Host "  SIGNTOOL: $($env:SIGNTOOL)"
+
               Write-Host "=== STEP A: cert into stores ==="
               $inUser = Get-ChildItem Cert:\CurrentUser\My -EA SilentlyContinue | ? { $_.Thumbprint -eq $thumb }
               if (-not $inUser) {