diff --git a/out/codeSign/macCodeSign.js b/out/codeSign/macCodeSign.js
index 9a69042fd48f4759a1c697bf23fa5b44f2da2366..193f42a8c4cb95ded694ba8ec0c27a5dcc94ed4c 100644
--- a/out/codeSign/macCodeSign.js
+++ b/out/codeSign/macCodeSign.js
@@ -156,16 +156,18 @@ async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscIK
     if (cscIKeyPassword != null) {
         cscPasswords.push(cscIKeyPassword);
     }
-    return await importCerts(keychainFile, certPaths, cscPasswords);
+    return await importCerts(keychainFile, certPaths, cscPasswords, keychainPassword);
 }
-async function importCerts(keychainFile, paths, keyPasswords) {
+async function importCerts(keychainFile, paths, keyPasswords, keychainPassword) {
     var _a;
     for (let i = 0; i < paths.length; i++) {
         const password = (_a = keyPasswords[i]) !== null && _a !== void 0 ? _a : "";
         await (0, builder_util_1.exec)("/usr/bin/security", ["import", paths[i], "-k", keychainFile, "-T", "/usr/bin/codesign", "-T", "/usr/bin/productbuild", "-P", password]);
         // https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p
         // https://github.com/electron-userland/electron-packager/issues/701#issuecomment-322315996
-        await (0, builder_util_1.exec)("/usr/bin/security", ["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", password, keychainFile]);
+        // `-k` expects the keychain's own unlock password (as used by create-keychain/unlock-keychain above),
+        // not the imported item's password used by `security import -P`.
+        await (0, builder_util_1.exec)("/usr/bin/security", ["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", keychainPassword, keychainFile]);
     }
     return {
         keychainFile,