diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f2cb82235..830896c4a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -168,11 +168,11 @@ jobs:
           MACOS_CERTIFICATE_BASE64: ${{ secrets.MACOS_CERTIFICATE_BASE64 }}
           MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
         run: |
-          # On PRs from forks the certificate secret is not available. Skip the
-          # signing setup; build-macos.sh produces an unsigned build when no
-          # identity is present.
+          # On PRs from forks the certificate secret isn't available, so skip
+          # the signing setup. build-macos.sh falls back to an ad-hoc signature
+          # when no identity is present.
           if [ -z "$MACOS_CERTIFICATE_BASE64" ]; then
-            echo "No macOS certificate secret; skipping signing setup (unsigned build)."
+            echo "No macOS certificate secret, skipping signing setup (ad-hoc signed build)."
             exit 0
           fi
 
diff --git a/build-macos.sh b/build-macos.sh
index 0528f46f1..1a5379199 100755
--- a/build-macos.sh
+++ b/build-macos.sh
@@ -97,7 +97,7 @@ fi
 UNSIGNED=0
 if [ -z "$APP_SIGN_ID" ] && [ -z "$TEAM_ID" ]; then
   UNSIGNED=1
-  echo "No signing identity available, building unsigned so PR builds still run."
+  echo "No signing identity available, ad-hoc signing so PR builds still run."
   PBXPROJ="$REPO_ROOT/macos/Runner.xcodeproj/project.pbxproj"
   cp "$PBXPROJ" "$PBXPROJ.signing.bak"
   trap 'mv -f "$PBXPROJ.signing.bak" "$PBXPROJ" 2>/dev/null || true' EXIT
@@ -130,7 +130,12 @@ ARCHIVE_CMD=(
   archive
 )
 if [ "$UNSIGNED" = "1" ]; then
-  ARCHIVE_CMD+=( CODE_SIGN_STYLE=Manual CODE_SIGN_IDENTITY="-" CODE_SIGNING_REQUIRED=NO )
+  # Ad-hoc sign rather than skipping signing. Don't add CODE_SIGNING_REQUIRED=NO
+  # here, because the CocoaPods framework script and the embedded emulator cores
+  # both check it and leave their bundles unsigned, which then fails the final
+  # CodeSign of the app. Arm64 binaries also need at least an ad-hoc signature
+  # to launch at all.
+  ARCHIVE_CMD+=( CODE_SIGN_STYLE=Manual CODE_SIGN_IDENTITY="-" )
 else
   ARCHIVE_CMD+=( CODE_SIGN_STYLE=Automatic )
   if [ -n "$TEAM_ID" ]; then