diff --git a/.appveyor.yml b/.appveyor.yml
index 692ce0b3d..e30463392 100644
--- a/.appveyor.yml
+++ b/.appveyor.yml
@@ -34,7 +34,7 @@ before_build:
   - ps: if ($env:BUILD_JOB -eq "build") { pwsh -NoProfile -ExecutionPolicy Unrestricted -Command .\build\windows\setup-keylocker.ps1 }
 
 build_script:
-  - ps: $env:SKIP_CODE_SIGNING=($env:APPVEYOR_REPO_BRANCH -ne "master")
+  - ps: $env:SIGN_CODE=( ($env:APPVEYOR_REPO_BRANCH -eq "master" ) -and ($env:APPVEYOR_REPO_TAG -eq 'true') )
   - ps: if ($env:BUILD_JOB -eq "build") { yarn dist }
 
 artifacts:
diff --git a/.github/workflows/linux.yaml b/.github/workflows/linux.yaml
index 49d0e6267..97505da2b 100644
--- a/.github/workflows/linux.yaml
+++ b/.github/workflows/linux.yaml
@@ -8,6 +8,8 @@ on:
   push:
     branches:
       - master
+    tags:
+      - '**'
   pull_request:
     paths-ignore:
       - '.github/workflows/macos.yaml'
diff --git a/.github/workflows/macos.yaml b/.github/workflows/macos.yaml
index 6c5592832..479a58647 100644
--- a/.github/workflows/macos.yaml
+++ b/.github/workflows/macos.yaml
@@ -8,6 +8,8 @@ on:
   push:
     branches:
       - master
+    tags:
+      - '**'
   pull_request:
     paths-ignore:
       - '.github/workflows/linux.yaml'
diff --git a/build/windows/customSign.js b/build/windows/customSign.js
index cde4bd96c..f31d78348 100644
--- a/build/windows/customSign.js
+++ b/build/windows/customSign.js
@@ -2,7 +2,7 @@
 'use strict'
 
 exports.default = async function (configuration) {
-  if (process.env.SKIP_CODE_SIGNING === 'True') {
+  if (process.env.SIGN_CODE !== 'True') {
     // eslint-disable-next-line no-console
     console.log('Skipping code signing')
     return
@@ -26,7 +26,7 @@ exports.default = async function (configuration) {
 
   try {
     const signCommand = `.\\build\\windows\\sign.ps1`
-    const keyPairAlias = `"${process.env.KEYPAIR_ALIAS}"`
+    const keyPairAlias = `"${process.env.SM_KEYPAIR_ALIAS}"`
     const sign = [
       `pwsh`,
       `-NoProfile`,