diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b43a3fcb..b5c1b708 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -78,6 +78,24 @@ jobs:
       - name: Build
         run: cargo build --release
 
+      - name: Sign executable (Azure Trusted Signing)
+        # Sign the bare .exe *before* the MSI is built so the copy packed
+        # into the installer carries the signature too. AZURE_CLIENT_SECRET
+        # authenticates the App Registration; the remaining AZURE_* secrets
+        # select the Trusted Signing account / certificate profile.
+        uses: azure/artifact-signing-action@v2
+        with:
+          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
+          endpoint: ${{ secrets.AZURE_ENDPOINT }}
+          signing-account-name: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
+          certificate-profile-name: ${{ secrets.AZURE_CERTIFICATE_PROFILE_NAME }}
+          files: ${{ github.workspace }}\target\release\OpenCADStudio.exe
+          file-digest: SHA256
+          timestamp-rfc3161: http://timestamp.acs.microsoft.com
+          timestamp-digest: SHA256
+
       - name: Convert SVG icon to ICO
         shell: pwsh
         run: |
@@ -93,7 +111,10 @@ jobs:
         shell: pwsh
         run: |
           $version = "${{ github.ref_name }}" -replace '^v', ''
-          if (-not $version) { $version = "0.0.0" }
+          # workflow_dispatch runs use the branch name as ref_name, which
+          # is not a valid MSI ProductVersion — fall back to 0.0.0 so test
+          # builds still produce an installer.
+          if ($version -notmatch '^\d+(\.\d+){0,3}$') { $version = "0.0.0" }
           # WiX Toolset 3.x is pre-installed on windows-latest; $env:WIX
           # points to the install root. candle compiles .wxs → .wixobj
           # and light links it into the final .msi.
@@ -120,6 +141,22 @@ jobs:
           & $light $wixObj -out $msiPath
           if ($LASTEXITCODE -ne 0) { throw "light failed" }
 
+      - name: Sign MSI installer (Azure Trusted Signing)
+        # The installer itself must be signed separately — light produces a
+        # fresh, unsigned .msi even though the .exe inside is already signed.
+        uses: azure/artifact-signing-action@v2
+        with:
+          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
+          endpoint: ${{ secrets.AZURE_ENDPOINT }}
+          signing-account-name: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
+          certificate-profile-name: ${{ secrets.AZURE_CERTIFICATE_PROFILE_NAME }}
+          files: ${{ github.workspace }}\OpenCADStudio.msi
+          file-digest: SHA256
+          timestamp-rfc3161: http://timestamp.acs.microsoft.com
+          timestamp-digest: SHA256
+
       - name: Upload artifacts to release
         if: github.event_name == 'release'
         shell: pwsh