diff --git a/.goreleaser.yml b/.goreleaser.yml
index b5abae4a8..01c727d93 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -9,7 +9,7 @@ before:
   hooks:
     - go mod tidy
     - make manpages GH_VERSION={{.Version}}
-    - ./script/prepare-windows-cert.sh "{{.Env.GITHUB_CERT_PASSWORD}}" "{{.Env.DESKTOP_CERT_TOKEN}}"
+    - ./script/prepare-windows-cert.sh '{{ if index .Env "GITHUB_CERT_PASSWORD"  }}{{ .Env.GITHUB_CERT_PASSWORD}}{{ end }}' '{{ if index .Env "DESKTOP_CERT_TOKEN"  }}{{ .Env.DESKTOP_CERT_TOKEN}}{{ end }}'
 
 builds:
   - <<: &build_defaults
@@ -35,7 +35,7 @@ builds:
     goarch: [386, amd64]
     hooks:
       post:
-        - ./script/sign-windows-executable.sh {{ .Path }}
+        - ./script/sign-windows-executable.sh '{{ .Path }}'
 
 archives:
   - id: nix
diff --git a/script/prepare-windows-cert.sh b/script/prepare-windows-cert.sh
index 92926c4d6..8bcd7d9b2 100755
--- a/script/prepare-windows-cert.sh
+++ b/script/prepare-windows-cert.sh
@@ -4,6 +4,11 @@ set -e
 GITHUB_CERT_PASSWORD=$1
 DESKTOP_CERT_TOKEN=$2
 
+if [[ -z "$GITHUB_CERT_PASSWORD" || -z "$DESKTOP_CERT_TOKEN" ]]; then
+  echo "skipping windows signing prep; cert password or token not found"
+  exit 0
+fi
+
 curl \
   -H "Authorization: token $DESKTOP_CERT_TOKEN" \
   -H "Accept: application/vnd.github.v3.raw" \
diff --git a/script/sign-windows-executable.sh b/script/sign-windows-executable.sh
index 77cf78ca8..6712ac764 100755
--- a/script/sign-windows-executable.sh
+++ b/script/sign-windows-executable.sh
@@ -1,8 +1,12 @@
 #!/bin/bash
 set -e
 
-EXECUTABLE_PATH=$1
+if [[ ! -e certificate.pem || ! -e private-key.pem ]]; then
+  echo "skipping windows signing; cert or key not found"
+  exit 0
+fi
 
+EXECUTABLE_PATH=$1
 ARCH="386"
 
 if [[ $EXECUTABLE_PATH =~ "amd64" ]]; then