diff --git a/.github/actions/publish/action.yml b/.github/actions/publish/action.yml
index b82fe58cd9..4ac9531746 100644
--- a/.github/actions/publish/action.yml
+++ b/.github/actions/publish/action.yml
@@ -145,6 +145,8 @@ runs:
         echo "version=${APPLICATION_VERSION}" >> $GITHUB_OUTPUT
 
       env:
+        # ensure we sign the artifacts
+        NODE_ENV: production
         # Apple notarization
         XCODE_APP_LOADER_EMAIL: ${{ inputs.XCODE_APP_LOADER_EMAIL }}
         XCODE_APP_LOADER_PASSWORD: ${{ fromJSON(inputs.secrets).XCODE_APP_LOADER_PASSWORD }}
diff --git a/.github/actions/test/action.yml b/.github/actions/test/action.yml
index a48d6baeab..cac7d2cdc2 100644
--- a/.github/actions/test/action.yml
+++ b/.github/actions/test/action.yml
@@ -64,7 +64,6 @@ runs:
       env:
         # https://www.electronjs.org/docs/latest/api/environment-variables
         ELECTRON_NO_ATTACH_CONSOLE: 'true'
-        ELECTRON_SKIP_NOTARIZATION: 'true'
 
     - name: Compress custom source
       if: runner.os != 'Windows'
diff --git a/forge.config.ts b/forge.config.ts
index 835568c5fb..25090fbea7 100644
--- a/forge.config.ts
+++ b/forge.config.ts
@@ -21,7 +21,7 @@ every byte of data was written correctly and much more.`;
 let osxSigningConfig: any = {};
 let winSigningConfig: any = {};
 
-if (process.env.NODE_ENV !== 'development' && process.env.ELECTRON_SKIP_NOTARIZATION !== 'true') {
+if (process.env.NODE_ENV === 'production') {
   osxSigningConfig.osxSign = {
     optionsForFile: () => ({
       entitlements: './entitlements.mac.plist',
@@ -139,7 +139,7 @@ const config: ForgeConfig = {
       env: 'ETCHER_UTIL_BIN_PATH',
       path: './out/sidecar/bin/etcher-util',
       build: {
-        command: 'tsc --project tsconfig.sidecar.json && pkg out/sidecar/util/api.js -c pkg-sidecar.json --target node18 --output out/sidecar/bin/etcher-util',
+        command: 'npm run build-sidecar',
         sources: './lib/util/',
       },
       verbose: true,
diff --git a/package.json b/package.json
index 67802ce252..9a29f3d8e9 100644
--- a/package.json
+++ b/package.json
@@ -14,6 +14,9 @@
     "url": "git@github.com:balena-io/etcher.git"
   },
   "scripts": {
+    "tsc": "tsc",
+    "pkg": "pkg",
+    "build-sidecar": "npm rebuild mountutils && npm run tsc -- --project tsconfig.sidecar.json && npm run pkg -- ./out/sidecar/util/api.js -c pkg-sidecar.json --target node18 --output ./out/sidecar/bin/etcher-util",
     "lint-css": "prettier --write lib/**/*.css",
     "lint-ts": "balena-lint --fix --typescript typings lib tests webpack.config.ts",
     "lint": "npm run lint-ts && npm run lint-css",
diff --git a/tsconfig.sidecar.json b/tsconfig.sidecar.json
index 9ce2d6e49b..4936dd3caa 100644
--- a/tsconfig.sidecar.json
+++ b/tsconfig.sidecar.json
@@ -12,7 +12,7 @@
     "moduleResolution": "Node",
     "resolveJsonModule": true,
     "isolatedModules": true,
-    "outDir": "out/sidecar"
+    "outDir": "./out/sidecar"
   },
-  "include": ["lib/util"]
+  "include": ["./lib/util"]
 }