diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9a83d14..59e07ef 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -33,14 +33,16 @@ jobs:
             cp "$RUNNER_TEMP/LICENSE" "$DIR/age"
             go build -o "$DIR/age" -ldflags "-X main.Version=$VERSION" -trimpath ./cmd/...
             if [ "$GOOS" == "windows" ]; then
-              for exe in "$DIR"/age/*.exe; do
-                /usr/bin/osslsigncode sign -t "http://timestamp.comodoca.com" \
-                  -certs .github/workflows/certs/uitacllc.crt \
-                  -key .github/workflows/certs/uitacllc.key \
-                  -pass "${{ secrets.SIGN_PASS }}" \
-                  -n age -in "$exe" -out "$exe.signed"
-                mv "$exe.signed" "$exe"
-              done
+              if [ -n "${{ secrets.SIGN_PASS }}" ]; then
+                for exe in "$DIR"/age/*.exe; do
+                  /usr/bin/osslsigncode sign -t "http://timestamp.comodoca.com" \
+                    -certs .github/workflows/certs/uitacllc.crt \
+                    -key .github/workflows/certs/uitacllc.key \
+                    -pass "${{ secrets.SIGN_PASS }}" \
+                    -n age -in "$exe" -out "$exe.signed"
+                  mv "$exe.signed" "$exe"
+                done
+              fi
               ( cd "$DIR"; zip age.zip -r age )
               mv "$DIR/age.zip" "age-$VERSION-$GOOS-$GOARCH.zip"
             else