diff --git a/.changes/fix-code-signing-after-patch.md b/.changes/fix-code-signing-after-patch.md
new file mode 100644
index 000000000..8825a1e22
--- /dev/null
+++ b/.changes/fix-code-signing-after-patch.md
@@ -0,0 +1,5 @@
+---
+tauri-bundler: "patch:bug"
+---
+
+The bundler now signs the main binary after patching it for every package type on windows
diff --git a/crates/tauri-bundler/src/bundle.rs b/crates/tauri-bundler/src/bundle.rs
index a14fd3ecb..9297bc597 100644
--- a/crates/tauri-bundler/src/bundle.rs
+++ b/crates/tauri-bundler/src/bundle.rs
@@ -84,6 +84,10 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<Bundle>> {
   if matches!(target_os, TargetPlatform::Windows) {
     if settings.can_sign() {
       for bin in settings.binaries() {
+        if bin.main() {
+          // we will sign the main binary after patching per "package type"
+          continue;
+        }
         let bin_path = settings.binary_path(bin);
         windows::sign::try_sign(&bin_path, settings)?;
       }
@@ -130,6 +134,12 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<Bundle>> {
       log::warn!("Failed to add bundler type to the binary: {e}. Updater plugin may not be able to update this package. This shouldn't normally happen, please report it to https://github.com/tauri-apps/tauri/issues");
     }
 
+    // sign main binary for every package type after patch
+    if matches!(target_os, TargetPlatform::Windows) && settings.can_sign() {
+      let bin_path = settings.binary_path(main_binary);
+      windows::sign::try_sign(&bin_path, settings)?;
+    }
+
     let bundle_paths = match package_type {
       #[cfg(target_os = "macos")]
       PackageType::MacOsBundle => macos::app::bundle_project(settings)?,