diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml
index c70ca283e..cd351b3d2 100644
--- a/.github/workflows/c-cpp.yml
+++ b/.github/workflows/c-cpp.yml
@@ -40,9 +40,13 @@ jobs:
           - os: windows-latest
             targetos: win32
             targetarch: amd64
+            env:
+              FWGS_PFX_PASSWORD: ${{ secrets.FWGS_PFX_PASSWORD }}
           - os: windows-2019 # always use the oldest possible for 32-bit because of older compilers, and better support of certain legacy OSes
             targetos: win32
             targetarch: i386
+            env:
+              FWGS_PFX_PASSWORD: ${{ secrets.FWGS_PFX_PASSWORD }}
           - os: macos-14 # in GitHub documentation, it's an ARM64 machine
             targetos: apple
             targetarch: arm64
diff --git a/scripts/gha/build_win32.sh b/scripts/gha/build_win32.sh
index 44dc8fcfa..ccf735325 100755
--- a/scripts/gha/build_win32.sh
+++ b/scripts/gha/build_win32.sh
@@ -17,13 +17,22 @@ fi
 
 if [ "$ARCH" = "i386" ]; then
 	cp SDL2_VC/lib/x86/SDL2.dll . # Install SDL2
-	cp 3rdparty/vgui_support/vgui-dev/lib/win32_vc6/vgui.dll .
 elif [ "$ARCH" = "amd64" ]; then
 	cp SDL2_VC/lib/x64/SDL2.dll .
 else
 	die
 fi
 
+WINSDK_LATEST=$(ls -1 "C:/Program Files (x86)/Windows Kits/10/bin" | grep -E '^10' | sort -rV | head -n1)
+echo "Latest installed Windows SDK is $WINSDK_LATEST"
+
+"C:/Program (x86)/Windows Kits/10/bin/$WINSDK_LATEST/x64/signtool.exe" \
+	/f scripts/fwgs.pfx /fd SHA256 /p "$FWGS_PFX_PASSWORD" *.dll *.exe
+
+if [ "$ARCH" = "i386" ]; then # VGUI is already signed
+	cp 3rdparty/vgui_support/vgui-dev/lib/win32_vc6/vgui.dll .
+fi
+
 mkdir -p artifacts/
 7z a -t7z artifacts/xash3d-fwgs-win32-$ARCH.7z -m0=lzma2 -mx=9 -mfb=64 -md=32m -ms=on \
 	*.dll *.exe *.pdb activities.txt \