diff --git a/.github/workflows/build-machines-and-homes.yml b/.github/workflows/build-machines-and-homes.yml
index bc1f2db..7e25ec2 100644
--- a/.github/workflows/build-machines-and-homes.yml
+++ b/.github/workflows/build-machines-and-homes.yml
@@ -55,6 +55,7 @@ jobs:
         if: always()
         run: |
           nix copy --all --to 's3://nixcache?endpoint=s3.cy7.sh' --verbose
+          nix store sign --store 's3://nixcache?endpoint=s3.cy7.sh' -k /home/runner/cache-priv-key.pem --all
   build-homes:
     strategy:
       fail-fast: false
@@ -94,3 +95,4 @@ jobs:
         if: always()
         run: |
           nix copy --all --to 's3://nixcache?endpoint=s3.cy7.sh' --verbose
+          nix store sign --store 's3://nixcache?endpoint=s3.cy7.sh' -k /home/runner/cache-priv-key.pem --all
diff --git a/.github/workflows/build-packages.yml b/.github/workflows/build-packages.yml
index c530cb7..5e779ac 100644
--- a/.github/workflows/build-packages.yml
+++ b/.github/workflows/build-packages.yml
@@ -45,6 +45,7 @@ jobs:
         if: always()
         run: |
           nix copy --all --to 's3://nixcache?endpoint=s3.cy7.sh' --verbose
+          nix store sign --store 's3://nixcache?endpoint=s3.cy7.sh' -k /home/runner/cache-priv-key.pem --all
       - name: prepare tarball to upload
         run: nix run github:nixos/nixpkgs#gnutar hcvf result.tar result
       - name: upload result