From c3ed64c40df781728bb48f4597aa0d91bbbab292 Mon Sep 17 00:00:00 2001
From: Brendan Allan <14191578+Brendonovich@users.noreply.github.com>
Date: Sun, 26 Jul 2026 03:19:04 +0000
Subject: [PATCH] fix(desktop): verify Windows updates

---
 packages/desktop/electron-builder.config.test.ts | 7 +++++++
 packages/desktop/electron-builder.config.ts      | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/packages/desktop/electron-builder.config.test.ts b/packages/desktop/electron-builder.config.test.ts
index eee2b825cb..cd75d691da 100644
--- a/packages/desktop/electron-builder.config.test.ts
+++ b/packages/desktop/electron-builder.config.test.ts
@@ -46,3 +46,10 @@ test("keeps a hidden prod launcher for old Linux pins", async () => {
   expect(desktop).toContain("StartupWMClass=ai.opencode.desktop")
   expect(desktop).toContain("NoDisplay=true")
 })
+
+test("verifies Windows update signatures", async () => {
+  const module = await import("./electron-builder.config.ts?signature=windows")
+  const config = module.default as Configuration
+
+  expect(config.win?.verifyUpdateCodeSignature).toBe(true)
+})
diff --git a/packages/desktop/electron-builder.config.ts b/packages/desktop/electron-builder.config.ts
index 23afe811c2..c26ffb88eb 100644
--- a/packages/desktop/electron-builder.config.ts
+++ b/packages/desktop/electron-builder.config.ts
@@ -83,7 +83,7 @@ const getBase = (appId: string): Configuration => ({
       sign: signWindows,
     },
     target: ["nsis"],
-    verifyUpdateCodeSignature: false,
+    verifyUpdateCodeSignature: true,
   },
   nsis: {
     oneClick: true,