diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml
index 3f5344bc..7aae5418 100644
--- a/.github/workflows/desktop-build.yml
+++ b/.github/workflows/desktop-build.yml
@@ -73,7 +73,7 @@ jobs:
           APPLE_TEAM_ID: ${{ secrets.EDGEEVER_APPLE_TEAM_ID }}
           WIN_CSC_LINK: ${{ secrets.EDGEEVER_WINDOWS_CERTIFICATE_BASE64 }}
           WIN_CSC_KEY_PASSWORD: ${{ secrets.EDGEEVER_WINDOWS_CERTIFICATE_PASSWORD }}
-        run: bun run --cwd apps/desktop dist -- --publish ${{ github.event_name == 'release' && 'always' || 'never' }}
+        run: bun scripts/run-desktop-builder.mjs --publish ${{ github.event_name == 'release' && 'always' || 'never' }}
 
       - name: Verify desktop installer
         run: bun scripts/verify-desktop-package.mjs
diff --git a/scripts/run-desktop-builder.mjs b/scripts/run-desktop-builder.mjs
new file mode 100644
index 00000000..cfd2b7c2
--- /dev/null
+++ b/scripts/run-desktop-builder.mjs
@@ -0,0 +1,34 @@
+import { spawnSync } from "node:child_process";
+
+const publishIndex = process.argv.indexOf("--publish");
+const publishMode = publishIndex >= 0 ? process.argv[publishIndex + 1] ?? "never" : "never";
+const environment = { ...process.env };
+
+// electron-builder treats an explicitly present empty CSC_LINK/WIN_CSC_LINK
+// as a path. Remove empty optional signing variables so unsigned CI builds
+// remain valid while non-empty secrets still enable signing and notarization.
+for (const key of [
+  "CSC_LINK",
+  "CSC_KEY_PASSWORD",
+  "APPLE_ID",
+  "APPLE_APP_SPECIFIC_PASSWORD",
+  "APPLE_TEAM_ID",
+  "WIN_CSC_LINK",
+  "WIN_CSC_KEY_PASSWORD",
+]) {
+  if (!environment[key]) delete environment[key];
+}
+environment.CSC_IDENTITY_AUTO_DISCOVERY ||= "false";
+
+const result = spawnSync(process.execPath, [
+  "run",
+  "--cwd",
+  "apps/desktop",
+  "dist",
+  "--",
+  "--publish",
+  publishMode,
+], { env: environment, stdio: "inherit" });
+
+if (result.error) throw result.error;
+process.exit(result.status ?? 1);