diff --git a/.github/workflows/release-windows.yaml b/.github/workflows/release-windows.yaml
index a2eb5553..016a88c4 100644
--- a/.github/workflows/release-windows.yaml
+++ b/.github/workflows/release-windows.yaml
@@ -35,9 +35,11 @@ jobs:
         run: npm clean-install
 
       - name: Build Windows executable
-        # code signing done later using Extended Verification (EV) with a hardware key
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # code signing using Extended Verification (EV) open source certificate
+          CSC_KEY_PASSWORD: ${{ secrets.WINDOWS_OSS_CERT_PASSWORD}}
+          CSC_LINK:  ${{ secrets.WINDOWS_OSS_CERT }}
         run: npm run build:desktop -- --windows --publish always
 
       - name: Save SBOM artifact