From f48571dc4d329946c8976037e3a0063aec7a70bc Mon Sep 17 00:00:00 2001
From: Jack Amadeo <jackamadeo@block.xyz>
Date: Thu, 9 Apr 2026 16:25:56 -0400
Subject: [PATCH] Fix windows signing env (#8412)

---
 .github/workflows/bundle-desktop-linux.yml   | 2 +-
 .github/workflows/bundle-desktop-windows.yml | 2 +-
 .github/workflows/release.yml                | 5 +++++
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/bundle-desktop-linux.yml b/.github/workflows/bundle-desktop-linux.yml
index 74345d3e2c..6203de8ba6 100644
--- a/.github/workflows/bundle-desktop-linux.yml
+++ b/.github/workflows/bundle-desktop-linux.yml
@@ -21,7 +21,7 @@ name: "Bundle Desktop (Linux)"
 jobs:
   build-desktop-linux:
     name: Build Desktop (Linux)
-    runs-on: ubuntu-x86-16core-64gb
+    runs-on: ubuntu-latest
 
     steps:
       - name: Checkout repository
diff --git a/.github/workflows/bundle-desktop-windows.yml b/.github/workflows/bundle-desktop-windows.yml
index 98ffb7351b..4acc1762e9 100644
--- a/.github/workflows/bundle-desktop-windows.yml
+++ b/.github/workflows/bundle-desktop-windows.yml
@@ -163,7 +163,7 @@ jobs:
     needs: build-desktop-windows
     if: inputs.signing
     runs-on: windows-latest
-    environment: ${{ (inputs.signing == true) && 'signing' || null }}
+    environment: ${{ inputs.signing && 'signing' || null }}
 
     steps:
       - name: Download unsigned distribution
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2e8dc7a35a..2a24d591b3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -76,8 +76,13 @@ jobs:
 #  # ------------------------------------------------------------
   bundle-desktop-windows:
     uses: ./.github/workflows/bundle-desktop-windows.yml
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
     with:
       signing: true
+    secrets: inherit
 
   # ------------------------------------
   # 7) Create/Update GitHub Release