diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml
index b4c93030..48a63517 100644
--- a/.github/workflows/desktop-build.yml
+++ b/.github/workflows/desktop-build.yml
@@ -122,12 +122,27 @@ jobs:
           cargo test --manifest-path crates/desktop-sidecar/Cargo.toml
           cargo build --manifest-path crates/desktop-sidecar/Cargo.toml --release
 
+      - name: Prepare Apple notarization API key
+        env:
+          APPLE_API_KEY_BASE64: ${{ secrets.EDGEEVER_APPLE_API_KEY_BASE64 }}
+          APPLE_API_KEY_ID: ${{ secrets.EDGEEVER_APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.EDGEEVER_APPLE_API_ISSUER }}
+        run: |
+          if [[ -z "$APPLE_API_KEY_BASE64" || -z "$APPLE_API_KEY_ID" || -z "$APPLE_API_ISSUER" ]]; then
+            echo "::error::Apple notarization API key secrets are required"
+            exit 1
+          fi
+
+          apple_api_key_path="$RUNNER_TEMP/AuthKey_${APPLE_API_KEY_ID}.p8"
+          printf '%s' "$APPLE_API_KEY_BASE64" | base64 -D > "$apple_api_key_path"
+          chmod 600 "$apple_api_key_path"
+          echo "APPLE_API_KEY=$apple_api_key_path" >> "$GITHUB_ENV"
+          echo "APPLE_API_KEY_ID=$APPLE_API_KEY_ID" >> "$GITHUB_ENV"
+          echo "APPLE_API_ISSUER=$APPLE_API_ISSUER" >> "$GITHUB_ENV"
+
       - name: Package desktop installer
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          APPLE_ID: ${{ secrets.EDGEEVER_APPLE_ID }}
-          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.EDGEEVER_APPLE_APP_SPECIFIC_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.EDGEEVER_APPLE_TEAM_ID }}
         run: bun scripts/run-desktop-builder.mjs --publish ${{ github.event_name == 'release' && 'always' || 'never' }}
 
       - name: Verify desktop installer