diff --git a/.github/workflows/tag-on-version-bump.yml b/.github/workflows/tag-on-version-bump.yml
index 0054ebc..f29c89d 100644
--- a/.github/workflows/tag-on-version-bump.yml
+++ b/.github/workflows/tag-on-version-bump.yml
@@ -45,5 +45,11 @@ jobs:
     uses: ./.github/workflows/release.yml
     with:
       tag: ${{ needs.tag.outputs.tag }}
+    # A called workflow gets no secrets unless they're handed over, so
+    # without this the signing secrets are empty inside release.yml and it
+    # quietly builds ad-hoc — which is exactly what signing exists to
+    # prevent, and which its own ad-hoc guard misses, since that guard only
+    # fires when an identity was configured.
+    secrets: inherit
     permissions:
       contents: write