diff --git a/.github/workflows/build_executable.yml b/.github/workflows/build_executable.yml
index f1600611..00b86fa9 100644
--- a/.github/workflows/build_executable.yml
+++ b/.github/workflows/build_executable.yml
@@ -242,9 +242,12 @@ jobs:
           SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
         run: |
           :: setup SSM KSP
-          curl -X GET  https://one.digicert.com/signingmanager/api-ui/v1/releases/smtools-windows-x64.msi/download -H "x-api-key:%SM_API_KEY%" -o smtools-windows-x64.msi 
+          curl -X GET  https://one.digicert.com/signingmanager/api-ui/v1/releases/smtools-windows-x64.msi/download -H "x-api-key:%SM_API_KEY%" -o smtools-windows-x64.msi
           msiexec /i smtools-windows-x64.msi /quiet /qn
           C:\Windows\System32\certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
+
+          :: certsync only syncs keypairs the calling identity has signing access to, so the
+          :: identity behind SM_API_KEY must be a signer on the certificate for this alias
           smctl windows certsync --keypair-alias=%SM_KEYPAIR_ALIAS%
 
           :: sign executable (in onedir mode the exe lives inside the collected directory)