diff --git a/.github/workflows/desktop-package.yml b/.github/workflows/desktop-package.yml
index 32a861682..907ebbb2f 100644
--- a/.github/workflows/desktop-package.yml
+++ b/.github/workflows/desktop-package.yml
@@ -520,6 +520,7 @@ jobs:
         env:
           BITFUN_SIGNING_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           BITFUN_SIGNING_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          BITFUN_SIGNING_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
         run: bash scripts/sign-release-assets.sh release-manual-assets/*.exe
 
       - name: Collect updater assets
diff --git a/scripts/check-github-config.test.mjs b/scripts/check-github-config.test.mjs
index 35885c242..b694ec6c3 100644
--- a/scripts/check-github-config.test.mjs
+++ b/scripts/check-github-config.test.mjs
@@ -275,3 +275,21 @@ test('keeps Rust CI independent, restore-only on PRs, and target-focused', () =>
     'cargo test --locked -p tool-runtime --lib search::',
   );
 });
+
+test('passes the verification key when signing the versioned Windows installer', () => {
+  const workflow = yaml.parse(
+    readFileSync(
+      path.join(repoRoot, '.github/workflows/desktop-package.yml'),
+      'utf8',
+    ),
+  );
+  const signingStep = workflow.jobs['upload-release-assets'].steps.find(
+    (step) => step.name === 'Sign versioned Windows installer',
+  );
+
+  assert.equal(
+    signingStep?.env?.BITFUN_SIGNING_PUBKEY,
+    '${{ secrets.TAURI_UPDATER_PUBKEY }}',
+    'release signatures must be self-verified with the configured public key',
+  );
+});