diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 46224b6..0311f36 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -54,6 +54,8 @@ jobs:
   build-macos:
     if: ${{ github.event_name == 'push' || inputs.platform == 'all' || inputs.platform == 'macos' }}
     runs-on: macos-latest
+    env:
+      HAS_CERT: ${{ secrets.MAC_CERT_P12_BASE64 != '' && 'true' || 'false' }}
     steps:
       - uses: actions/checkout@v4
 
@@ -68,9 +70,15 @@ jobs:
       - name: Build Electron app
         run: npm run electron:build
 
+      - name: Decode signing certificate
+        if: ${{ env.HAS_CERT == 'true' }}
+        env:
+          MAC_CERT_P12_BASE64: ${{ secrets.MAC_CERT_P12_BASE64 }}
+        run: echo "$MAC_CERT_P12_BASE64" | base64 --decode > /tmp/cert.p12
+
       - name: Package for macOS (x64 + arm64)
         env:
-          CSC_LINK: ${{ secrets.MAC_CERT_P12_BASE64 }}
+          CSC_LINK: ${{ env.HAS_CERT == 'true' && '/tmp/cert.p12' || '' }}
           CSC_KEY_PASSWORD: ${{ secrets.MAC_CERT_PASSWORD }}
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
@@ -78,6 +86,7 @@ jobs:
         run: npx electron-builder --mac --config electron-builder.yml --publish never
 
       - name: Verify code signature
+        if: ${{ env.HAS_CERT == 'true' }}
         run: |
           # Verify every .app bundle produced (arm64 + x64)
           APPS=$(find release -name "CodePilot.app" -maxdepth 3)