diff --git a/js/forge.config.ts b/js/forge.config.ts
index 13ee4cc..76997a6 100644
--- a/js/forge.config.ts
+++ b/js/forge.config.ts
@@ -10,14 +10,16 @@ import { FuseV1Options, FuseVersion } from '@electron/fuses';
 // Windows code signing via Azure Trusted Signing. Dormant unless the workflow
 // provisions the dlib + metadata file and exports these env vars, so local
 // `yarn make` and unsigned CI builds both work unchanged.
+// @electron/windows-sign prepends `sign /tr <timestampServer> /td sha256 /fd sha256`
+// to the sha256 pass, so `signWithParams` only carries the Azure Trusted Signing
+// bits. Skip the sha1 pass (deprecated; not supported by Trusted Signing).
 const windowsSign = process.env.AZURE_METADATA_JSON_PATH ? {
   debug: true,
   signToolPath: process.env.SIGNTOOL_PATH,
+  hashes: ['sha256' as any],
+  timestampServer: 'http://timestamp.acs.microsoft.com',
   signWithParams: [
     '/v',
-    '/fd', 'SHA256',
-    '/tr', 'http://timestamp.acs.microsoft.com',
-    '/td', 'SHA256',
     '/dlib', process.env.AZURE_DLIB_PATH,
     '/dmdf', process.env.AZURE_METADATA_JSON_PATH,
   ].join(' '),