diff --git a/.github/workflows/desktop-package.yml b/.github/workflows/desktop-package.yml
index 86b643e6f..3b6eaa91c 100644
--- a/.github/workflows/desktop-package.yml
+++ b/.github/workflows/desktop-package.yml
@@ -324,6 +324,9 @@ jobs:
             --repo "GCWing/BitFun" \
             --out linux-release-assets/linux-binaries.json
 
+      - name: Setup Rust toolchain (minisign fallback)
+        uses: dtolnay/rust-toolchain@stable
+
       # The Tauri bundler signs the five updater artifacts during `tauri build`,
       # but the installers people download by hand from the release page — dmg,
       # deb, rpm, the Windows installer and the direct AppImages — shipped with
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index bdc93d1c4..afa215166 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -279,6 +279,9 @@ jobs:
             --repo "GCWing/BitFun" \
             --out linux-release-assets/linux-binaries.json
 
+      - name: Setup Rust toolchain (minisign fallback)
+        uses: dtolnay/rust-toolchain@stable
+
       # The Tauri bundler signs the five updater artifacts during `tauri build`,
       # but the installers people download by hand from the release page — dmg,
       # deb, rpm, the Windows installer and the direct AppImages — shipped with
diff --git a/scripts/sign-release-assets.sh b/scripts/sign-release-assets.sh
index 24adb2a11..4a6e04c85 100755
--- a/scripts/sign-release-assets.sh
+++ b/scripts/sign-release-assets.sh
@@ -34,7 +34,18 @@ fi
 
 if ! command -v minisign >/dev/null 2>&1; then
   echo "[sign] Installing minisign..."
-  sudo apt-get install -y --no-install-recommends minisign >/dev/null
+  # Ubuntu's package is not available in the default repositories on every
+  # runner image (notably ubuntu-24.04-arm). Prefer it when present, then use
+  # the portable Rust distribution as a fallback.
+  if ! sudo apt-get install -y --no-install-recommends minisign >/dev/null 2>&1; then
+    if ! command -v cargo >/dev/null 2>&1; then
+      echo "[sign] ERROR: minisign is unavailable and cargo is not installed." >&2
+      exit 1
+    fi
+    MINISIGN_ROOT="${RUNNER_TEMP:-${TMPDIR:-/tmp}}/bitfun-minisign"
+    cargo install --registry crates-io --locked --root "$MINISIGN_ROOT" minisign >/dev/null
+    export PATH="$MINISIGN_ROOT/bin:$PATH"
+  fi
 fi
 
 WORK="$(mktemp -d)"