diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8174d028..ef402cd4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -466,20 +466,23 @@ jobs:
       # cleanup step is needed.  It is pinned to a commit rather than a tag
       # because it handles the certificate and its password.
       - name: Import the Developer ID certificate
-        uses: Apple-Actions/import-codesign-certs@5142e029c445c10ffc7149d172e540235a065466  # v7.0.0
+        id: signing_certificate
+        uses: Apple-Actions/import-codesign-certs@77ba2a2a8f5cfc8c405ebf3159f767c323e238f9  # v7.1.0
         with:
           p12-file-base64: ${{ secrets.DEVELOPER_ID_APP_CERT_P12_BASE64 }}
           p12-password: ${{ secrets.DEVELOPER_ID_APP_CERT_PASSWORD }}
 
       - name: Sign the macOS binaries
+        env:
+          IDENTITIES: ${{ steps.signing_certificate.outputs.identities }}
         run: |
-          # ``--sign`` takes a name prefix, and matches the one Developer ID
-          # identity in the keychain the previous step added to the search
-          # list.  It fails with "ambiguous" if more than one matches, so
-          # this needs no lookup.  There is deliberately no ``--keychain``:
-          # that flag silently falls back to the search list when it cannot
-          # resolve what it is given, so it constrains nothing.
-          #
+          signing_identity="$(jq -er '
+            [.[] | select(.name | startswith("Developer ID Application:"))]
+            | if length == 1 then .[0].hash
+              else error("Expected exactly one Developer ID Application identity; found \(length)")
+              end
+          ' <<< "$IDENTITIES")"
+
           # A secure timestamp and the hardened runtime are both
           # prerequisites for notarization.  The hardened runtime needs the
           # entitlements file to leave a ``--onefile`` binary runnable; see
@@ -490,7 +493,7 @@ jobs:
                   --timestamp \
                   --options runtime \
                   --entitlements bin/entitlements.plist \
-                  --sign "Developer ID Application" \
+                  --sign "$signing_identity" \
                   "dist/${binary}"
               codesign --verify --strict --verbose=2 "dist/${binary}"
           done