diff --git a/.github/workflows/slsa-releaser.yml b/.github/workflows/slsa-releaser.yml
index ee0ed4d..6d1175d 100644
--- a/.github/workflows/slsa-releaser.yml
+++ b/.github/workflows/slsa-releaser.yml
@@ -55,8 +55,10 @@ jobs:
         uses: softprops/action-gh-release@v1
         if: startsWith(github.ref, 'refs/tags/')
         with:
+        # TODO: stop releasing the unsigned files
           files: |
             hishtory-darwin-arm64
+            hishtory-darwin-arm64-unsigned
             hishtory-darwin-amd64
 
   # Upload to GitHub release.
diff --git a/scripts/actions-sign.py b/scripts/actions-sign.py
index 5435a52..207c72e 100644
--- a/scripts/actions-sign.py
+++ b/scripts/actions-sign.py
@@ -20,6 +20,7 @@ def main():
 
     print("signing...")
     os.system("""
+    cp hishtory-darwin-arm64 hishtory-darwin-arm64-unsigned
     echo $MACOS_CERTIFICATE | base64 -d > certificate.p12
     security create-keychain -p $MACOS_CERTIFICATE_PWD build.keychain
     security default-keychain -s build.keychain