diff --git a/installer/build.bat b/installer/build.bat
index c9da9c91..dff90972 100644
--- a/installer/build.bat
+++ b/installer/build.bat
@@ -40,11 +40,6 @@ if exist .deps\prepared goto :build
 	call :msi amd64 x86_64 x64 || goto :error
 	call :msi arm armv7 arm || goto :error
 	call :msi arm64 aarch64 arm64 || goto :error
-	if exist ..\sign.bat call ..\sign.bat
-	if "%SigningCertificate%"=="" goto :success
-	if "%TimestampServer%"=="" goto :success
-	echo [+] Signing
-	signtool sign /sha1 "%SigningCertificate%" /fd sha256 /tr "%TimestampServer%" /td sha256 /d "WireGuard Setup" "dist\wireguard-*-%WIREGUARD_VERSION%.msi" || goto :error
 
 :success
 	echo [+] Success.
@@ -63,8 +58,18 @@ if exist .deps\prepared goto :build
 	echo [+] Compiling %1
 	%CC% %CFLAGS% %LDFLAGS% -o "%~1\customactions.dll" customactions.c %LDLIBS% || exit /b 1
 	"%WIX%bin\candle" %WIX_CANDLE_FLAGS% -dWIREGUARD_PLATFORM="%~1" -out "%~1\wireguard.wixobj" -arch %3 wireguard.wxs || exit /b %errorlevel%
+	call :sign %~1\customactions.dll || goto :error
 	echo [+] Linking %1
 	"%WIX%bin\light" %WIX_LIGHT_FLAGS% -out "dist\wireguard-%~1-%WIREGUARD_VERSION%.msi" "%~1\wireguard.wixobj" || exit /b %errorlevel%
+	call :sign dist\wireguard-%~1-%WIREGUARD_VERSION%.msi || goto :error
+	goto :eof
+
+:sign
+	if exist ..\sign.bat call ..\sign.bat
+	if "%SigningCertificate%"=="" goto :eof
+	if "%TimestampServer%"=="" goto :eof
+	echo [+] Signing %1
+	signtool sign /sha1 "%SigningCertificate%" /fd sha256 /tr "%TimestampServer%" /td sha256 /d "WireGuard Setup" "%~1" || exit /b %errorlevel%
 	goto :eof
 
 :error