diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 29e165a392..4d0a8f0b7e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -66,8 +66,16 @@ jobs:
           architecture: ${{ matrix.arch }}
       - name: Setup Ant
         uses: cedx/setup-ant@v3
+      - name: Install Certificates for Code Signing
+        if: ${{ matrix.os_prefix == 'macos' }}
+        uses: apple-actions/import-codesign-certs@v3
+        with:
+          p12-file-base64: ${{ secrets.CERTIFICATES_P12 }}
+          p12-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }}
       - name: Build Release
         run: ant -noinput -buildfile build/build.xml ${{ matrix.os_prefix }}-dist -Dversion="${{ github.sha }}"
+        env:
+          PROCESSING_APP_SIGNING: true
       - name: Add artifact
         uses: actions/upload-artifact@v4
         with:
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 54ae96e71c..53caf7fb9e 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -51,8 +51,16 @@ jobs:
           architecture: ${{ matrix.arch }}
       - name: Setup Ant
         uses: cedx/setup-ant@v3
+      - name: Install Certificates for Code Signing
+        if: ${{ matrix.os_prefix == 'macos' }}
+        uses: apple-actions/import-codesign-certs@v3
+        with:
+          p12-file-base64: ${{ secrets.CERTIFICATES_P12 }}
+          p12-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }}
       - name: Build Release
         run: ant -noinput -buildfile build/build.xml ${{ matrix.os_prefix }}-dist -Dversion="${{ github.sha }}"
+        env:
+          PROCESSING_APP_SIGNING: true
       - name: Add artifact
         uses: actions/upload-artifact@v3
         id: upload
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b5712ab3e2..2e56749b25 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -104,6 +104,7 @@ jobs:
       - name: Build Release
         run: ant -noinput -buildfile build/build.xml ${{ matrix.os_prefix }}-dist -Dversion="${{ needs.version.outputs.version }}"
         env:
+          PROCESSING_APP_SIGNING: true
           PROCESSING_APP_PASSWORD: ${{ secrets.PROCESSING_APP_PASSWORD }}
           PROCESSING_APPLE_ID: ${{ secrets.PROCESSING_APPLE_ID }}
           PROCESSING_TEAM_ID: ${{ secrets.PROCESSING_TEAM_ID }}
diff --git a/build/build.xml b/build/build.xml
index 4d873869bb..ab22501d52 100644
--- a/build/build.xml
+++ b/build/build.xml
@@ -778,7 +778,7 @@
     </exec>
   </target>
 
-  <target name="macos-dist-sign" if="env.PROCESSING_APP_PASSWORD">
+  <target name="macos-dist-sign" if="env.PROCESSING_APP_SIGNING">
     <echo>
       Code signing will only work if you have a $99/yr Apple developer ID.
     </echo>