diff --git a/.github/workflows/linux-release-build.yml b/.github/workflows/linux-release-build.yml
index 5e5a32bff..baaea9dbf 100644
--- a/.github/workflows/linux-release-build.yml
+++ b/.github/workflows/linux-release-build.yml
@@ -105,6 +105,8 @@ jobs:
           SURFER_COMPAT: ${{ matrix.arch }}
           SURFER_CERT_PATCH_ISSUER: ${{ secrets.SURFER_CERT_PATCH_ISSUER }}
           SURFER_CERT_PATCH_NAME: ${{ secrets.SURFER_CERT_PATCH_NAME }}
+          SURFER_CERT_PATCH_NAME_PREV: ${{ secrets.SURFER_CERT_PATCH_NAME_PREV }}
+          SURFER_CERT_PATCH_ISSUER_PREV: ${{ secrets.SURFER_CERT_PATCH_ISSUER_PREV }}
         run: |
           . "$HOME/.cargo/env"
           npm run import
diff --git a/.github/workflows/macos-release-build.yml b/.github/workflows/macos-release-build.yml
index 514e323cb..0423c566e 100644
--- a/.github/workflows/macos-release-build.yml
+++ b/.github/workflows/macos-release-build.yml
@@ -122,6 +122,8 @@ jobs:
           SURFER_COMPAT: ${{ matrix.arch }}
           SURFER_CERT_PATCH_ISSUER: ${{ secrets.SURFER_CERT_PATCH_ISSUER }}
           SURFER_CERT_PATCH_NAME: ${{ secrets.SURFER_CERT_PATCH_NAME }}
+          SURFER_CERT_PATCH_NAME_PREV: ${{ secrets.SURFER_CERT_PATCH_NAME_PREV }}
+          SURFER_CERT_PATCH_ISSUER_PREV: ${{ secrets.SURFER_CERT_PATCH_ISSUER_PREV }}
           SURFER_PLATFORM: darwin
         run: |
           . "$HOME/.cargo/env"
diff --git a/.github/workflows/windows-release-build.yml b/.github/workflows/windows-release-build.yml
index bde059b91..e27d50589 100644
--- a/.github/workflows/windows-release-build.yml
+++ b/.github/workflows/windows-release-build.yml
@@ -166,6 +166,8 @@ jobs:
           SURFER_COMPAT: ${{ matrix.arch }}
           SURFER_CERT_PATCH_ISSUER: ${{ secrets.SURFER_CERT_PATCH_ISSUER }}
           SURFER_CERT_PATCH_NAME: ${{ secrets.SURFER_CERT_PATCH_NAME }}
+          SURFER_CERT_PATCH_NAME_PREV: ${{ secrets.SURFER_CERT_PATCH_NAME_PREV }}
+          SURFER_CERT_PATCH_ISSUER_PREV: ${{ secrets.SURFER_CERT_PATCH_ISSUER_PREV }}
         run: |
           . "$HOME/.cargo/env"
           npm run import -- --verbose
diff --git a/build/windows/sign.ps1 b/build/windows/sign.ps1
index aa1226840..1ca23ea34 100644
--- a/build/windows/sign.ps1
+++ b/build/windows/sign.ps1
@@ -3,8 +3,6 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 param(
-    [string][Parameter(Mandatory=$true)]$SignIdentity,
-    [string][Parameter(Mandatory=$true)]$SignIdentityIssuer,
     [string][Parameter(Mandatory=$true)]$GithubRunId
 )
 
@@ -24,12 +22,23 @@ mkdir windsign-temp -ErrorAction SilentlyContinue
 #    echo "Downloaded git objects repo to"
 #} -Verbose -ArgumentList $PWD -Debug
 
+$token = gh auth token
+
 $env:SURFER_MOZCONFIG_ONLY="1"
 $env:SURFER_SIGNING_MODE=""
 
+# Fetch SignIdentity from the github repo secrets, with the name SURFER_CERT_PATCH_ISSUER
+$SignIdentityIssuer = (Invoke-RestMethod -Uri "https://api.github.com/repos/zen-browser/desktop/actions/secrets/SURFER_CERT_PATCH_ISSUER" -Headers @{Authorization = "Bearer $token"}).value
+$SignIdentity = (Invoke-RestMethod -Uri "https://api.github.com/repos/zen-browser/desktop/actions/secrets/SURFER_CERT_PATCH_NAME" -Headers @{Authorization = "Bearer $token"}).value
+$SignIndentityIssuerPrev = (Invoke-RestMethod -Uri "https://api.github.com/repos/zen-browser/desktop/actions/secrets/SURFER_CERT_PATCH_ISSUER_PREV" -Headers @{Authorization = "Bearer $token"}).value
+$SignIdentityPrev = (Invoke-RestMethod -Uri "https://api.github.com/repos/zen-browser/desktop/actions/secrets/SURFER_CERT_PATCH_NAME_PREV" -Headers @{Authorization = "Bearer $token"}).
+
 $env:SURFER_CERT_PATCH_ISSUER=$SignIdentityIssuer
 $env:SURFER_CERT_PATCH_NAME=$SignIdentity
 
+$env:SURFER_CERT_PATCH_NAME_PREV=$SignIdentityPrev
+$env:SURFER_CERT_PATCH_ISSUER_PREV=$SignIndentityIssuerPrev
+
 Start-Job -Name "DownloadGitl10n" -ScriptBlock {
     param($PWD)
     cd $PWD
@@ -46,7 +55,6 @@ npm run build
 
 echo "Downloading artifacts info"
 $artifactsInfo=gh api repos/zen-browser/desktop/actions/runs/$GithubRunId/artifacts
-$token = gh auth token
 
 function New-TemporaryDirectory {
     $tmp = [System.IO.Path]::GetTempPath() # Not $env:TEMP, see https://stackoverflow.com/a/946017
diff --git a/package-lock.json b/package-lock.json
index 3d38fe17b..484c33d77 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,7 +11,7 @@
       "devDependencies": {
         "@babel/preset-typescript": "^7.27.0",
         "@zen-browser/prettier": "^3.9.3",
-        "@zen-browser/surfer": "^1.14.7",
+        "@zen-browser/surfer": "^1.14.8",
         "formal-git": "^1.2.9",
         "globals": "^16.3.0",
         "husky": "^9.1.7",
@@ -860,9 +860,9 @@
       }
     },
     "node_modules/@zen-browser/surfer": {
-      "version": "1.14.7",
-      "resolved": "https://registry.npmjs.org/@zen-browser/surfer/-/surfer-1.14.7.tgz",
-      "integrity": "sha512-Ui2Chqvr4/+FmHM54eKOv7cQu8DRAK/uCX9o1GNi81hszxo/RSQwaw71eNW43Qcj7giK4U4x0IdCMht98iQ0rA==",
+      "version": "1.14.8",
+      "resolved": "https://registry.npmjs.org/@zen-browser/surfer/-/surfer-1.14.8.tgz",
+      "integrity": "sha512-5HHcfibwHIK5n3huhJL2TLBX2+8odj6ebCMA6U2EcUj9ROSrcz7/bjY2n5MIa9oIRL9gtV3ott0jwJj6SlapxA==",
       "dev": true,
       "license": "MPL-2.0",
       "dependencies": {
diff --git a/package.json b/package.json
index 54edce0c8..c0ed6239c 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
   "devDependencies": {
     "@babel/preset-typescript": "^7.27.0",
     "@zen-browser/prettier": "^3.9.3",
-    "@zen-browser/surfer": "^1.14.7",
+    "@zen-browser/surfer": "^1.14.8",
     "formal-git": "^1.2.9",
     "globals": "^16.3.0",
     "husky": "^9.1.7",