diff --git a/.gitea/workflows/custom-release.yml b/.gitea/workflows/custom-release.yml
index ec9ec4f53..67f8fa59f 100644
--- a/.gitea/workflows/custom-release.yml
+++ b/.gitea/workflows/custom-release.yml
@@ -60,13 +60,11 @@ jobs:
           keychain_path="$keychain_dir/syncthing-release-signing-${GITHUB_RUN_ID:-$$}.keychain-db"
           keychain_password="$(openssl rand -hex 24)"
           certificate_path="$RUNNER_TEMP/developer-id-application.p12"
-          previous_default_keychain="$(security default-keychain -d user 2>/dev/null | sed 's/[ "]//g' || true)"
-          previous_dynamic_default_keychain="$(security default-keychain -d dynamic 2>/dev/null | sed 's/[ "]//g' || true)"
+          previous_default_keychain="$(security default-keychain 2>/dev/null | sed 's/[ "]//g' || true)"
 
           echo "CUSTOM_RELEASE_KEYCHAIN_PATH=$keychain_path" >> "$GITHUB_ENV"
           echo "CUSTOM_RELEASE_KEYCHAIN_PASSWORD=$keychain_password" >> "$GITHUB_ENV"
           echo "CUSTOM_RELEASE_PREVIOUS_DEFAULT_KEYCHAIN=$previous_default_keychain" >> "$GITHUB_ENV"
-          echo "CUSTOM_RELEASE_PREVIOUS_DYNAMIC_DEFAULT_KEYCHAIN=$previous_dynamic_default_keychain" >> "$GITHUB_ENV"
 
           if [ -z "$DEVELOPER_ID_APPLICATION_P12_BASE64" ]; then
             echo "DEVELOPER_ID_APPLICATION_P12_BASE64 secret is required" >&2
@@ -82,16 +80,16 @@ jobs:
           existing_keychains=()
           while IFS= read -r existing_keychain; do
             existing_keychain="$(printf '%s' "$existing_keychain" | sed 's/[ "]//g')"
-            if [ -n "$existing_keychain" ] && [ -e "$existing_keychain" ]; then
+            if [ -n "$existing_keychain" ] && [ -e "$existing_keychain" ] && [[ "$existing_keychain" != *"/syncthing-release-signing-"*".keychain-db" ]]; then
               existing_keychains+=("$existing_keychain")
             fi
-          done < <(security list-keychains -d user)
-          security list-keychains -d user -s "$keychain_path" "${existing_keychains[@]}"
-          security list-keychains -d dynamic -s "$keychain_path" "${existing_keychains[@]}" || true
-          security default-keychain -d user -s "$keychain_path"
-          security default-keychain -d dynamic -s "$keychain_path" || true
-          security list-keychains -d user
-          security list-keychains -d dynamic || true
+          done < <(security list-keychains)
+          security list-keychains -s "$keychain_path" "${existing_keychains[@]}"
+          security list-keychains -d user -s "$keychain_path" "${existing_keychains[@]}" || true
+          security default-keychain -s "$keychain_path"
+          security default-keychain -d user -s "$keychain_path" || true
+          security list-keychains
+          security list-keychains -d user || true
           security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$keychain_password" "$keychain_path"
           identity_output="$(security find-identity -v -p codesigning "$keychain_path")"
           printf '%s\n' "$identity_output"
@@ -105,7 +103,7 @@ jobs:
 
           probe_binary="$RUNNER_TEMP/codesign-probe"
           cp /usr/bin/true "$probe_binary"
-          codesign --force --dryrun --sign "$codesign_identity" --options runtime --timestamp "$probe_binary"
+          codesign --force --dryrun --sign "$codesign_identity" --keychain "$keychain_path" --options runtime --timestamp "$probe_binary"
 
           echo "CUSTOM_RELEASE_CODESIGN_IDENTITY=$codesign_identity" >> "$GITHUB_ENV"
           echo "CUSTOM_RELEASE_CODESIGN_IDENTITY_SHA1=$codesign_identity_sha1" >> "$GITHUB_ENV"
@@ -130,11 +128,9 @@ jobs:
         if: always()
         run: |
           if [ -n "${CUSTOM_RELEASE_PREVIOUS_DEFAULT_KEYCHAIN:-}" ] && [ -e "$CUSTOM_RELEASE_PREVIOUS_DEFAULT_KEYCHAIN" ]; then
+            security default-keychain -s "$CUSTOM_RELEASE_PREVIOUS_DEFAULT_KEYCHAIN" || true
             security default-keychain -d user -s "$CUSTOM_RELEASE_PREVIOUS_DEFAULT_KEYCHAIN" || true
           fi
-          if [ -n "${CUSTOM_RELEASE_PREVIOUS_DYNAMIC_DEFAULT_KEYCHAIN:-}" ] && [ -e "$CUSTOM_RELEASE_PREVIOUS_DYNAMIC_DEFAULT_KEYCHAIN" ]; then
-            security default-keychain -d dynamic -s "$CUSTOM_RELEASE_PREVIOUS_DYNAMIC_DEFAULT_KEYCHAIN" || true
-          fi
           if [ -n "${CUSTOM_RELEASE_KEYCHAIN_PATH:-}" ]; then
             security delete-keychain "$CUSTOM_RELEASE_KEYCHAIN_PATH" || true
           fi
diff --git a/scripts/tests/test-custom-release-macos-runner.bats b/scripts/tests/test-custom-release-macos-runner.bats
index 98dc7e001..5498fa9a6 100644
--- a/scripts/tests/test-custom-release-macos-runner.bats
+++ b/scripts/tests/test-custom-release-macos-runner.bats
@@ -47,7 +47,7 @@ setup() {
 	run rg -n 'security find-identity -v -p codesigning "\$keychain_path"' "$WORKFLOW"
 	[ "$status" -eq 0 ]
 
-	run rg -n 'security default-keychain -d user -s "\$keychain_path"' "$WORKFLOW"
+	run rg -n 'security default-keychain -s "\$keychain_path"' "$WORKFLOW"
 	[ "$status" -eq 0 ]
 
 	run rg -n 'previous_default_keychain=' "$WORKFLOW"
@@ -56,14 +56,14 @@ setup() {
 	run rg -n 'CUSTOM_RELEASE_PREVIOUS_DEFAULT_KEYCHAIN=\$previous_default_keychain' "$WORKFLOW"
 	[ "$status" -eq 0 ]
 
-	run rg -n 'CUSTOM_RELEASE_PREVIOUS_DYNAMIC_DEFAULT_KEYCHAIN=\$previous_dynamic_default_keychain' "$WORKFLOW"
+	run rg -n 'CUSTOM_RELEASE_PREVIOUS_DYNAMIC_DEFAULT_KEYCHAIN' "$WORKFLOW"
+	[ "$status" -ne 0 ]
+
+	run rg -n 'security default-keychain -s "\$CUSTOM_RELEASE_PREVIOUS_DEFAULT_KEYCHAIN"' "$WORKFLOW"
 	[ "$status" -eq 0 ]
 
-	run rg -n 'security default-keychain -d user -s "\$CUSTOM_RELEASE_PREVIOUS_DEFAULT_KEYCHAIN"' "$WORKFLOW"
-	[ "$status" -eq 0 ]
-
-	run rg -n 'security default-keychain -d dynamic -s "\$CUSTOM_RELEASE_PREVIOUS_DYNAMIC_DEFAULT_KEYCHAIN"' "$WORKFLOW"
-	[ "$status" -eq 0 ]
+	run rg -n 'security default-keychain -d dynamic' "$WORKFLOW"
+	[ "$status" -ne 0 ]
 
 	run rg -n 'security find-identity -v -p codesigning$' "$WORKFLOW" "$RELEASE_SCRIPT"
 	[ "$status" -eq 0 ]
@@ -83,7 +83,7 @@ setup() {
 	run rg -n 'CUSTOM_RELEASE_KEYCHAIN_PASSWORD=\$keychain_password' "$WORKFLOW"
 	[ "$status" -eq 0 ]
 
-	run rg -n 'codesign --force --dryrun --sign "\$codesign_identity" --options runtime --timestamp "\$probe_binary"' "$WORKFLOW"
+	run rg -n 'codesign --force --dryrun --sign "\$codesign_identity" --keychain "\$keychain_path" --options runtime --timestamp "\$probe_binary"' "$WORKFLOW"
 	[ "$status" -eq 0 ]
 
 	run rg -n 'CUSTOM_RELEASE_CODESIGN_IDENTITY: "Developer ID Application' "$WORKFLOW"
@@ -101,11 +101,11 @@ setup() {
 	run rg -n 'existing_keychains=\(\)' "$WORKFLOW"
 	[ "$status" -eq 0 ]
 
-	run rg -n 'security list-keychains -d user$' "$WORKFLOW"
+	run rg -n 'security list-keychains -s "\$keychain_path"' "$WORKFLOW"
 	[ "$status" -eq 0 ]
 
-	run rg -n 'security list-keychains -d dynamic -s "\$keychain_path"' "$WORKFLOW"
-	[ "$status" -eq 0 ]
+	run rg -n 'security list-keychains -d dynamic' "$WORKFLOW"
+	[ "$status" -ne 0 ]
 
 	run rg -n 'security import' "$WORKFLOW"
 	[ "$status" -eq 0 ]
@@ -130,7 +130,7 @@ setup() {
 	[ "$status" -eq 0 ]
 
 	run rg -n -- '--keychain "\$CUSTOM_RELEASE_KEYCHAIN_PATH"' "$RELEASE_SCRIPT"
-	[ "$status" -ne 0 ]
+	[ "$status" -eq 0 ]
 
 	run rg -n 'codesign_args\+=\(--options runtime --timestamp\)' "$RELEASE_SCRIPT"
 	[ "$status" -eq 0 ]
@@ -143,8 +143,9 @@ setup() {
 
 	run awk '
 		/codesign_args=\(--force --sign "\$codesign_identity"\)/ { sign = NR }
+		/codesign_args\+=\(--keychain "\$CUSTOM_RELEASE_KEYCHAIN_PATH"\)/ { keychain = NR }
 		/codesign_args\+=\(--options runtime --timestamp\)/ { options = NR }
-		END { exit !(sign && options && sign < options) }
+		END { exit !(sign && keychain && options && sign < keychain && keychain < options) }
 	' "$RELEASE_SCRIPT"
 	[ "$status" -eq 0 ]
 
diff --git a/scripts/update-custom-release.sh b/scripts/update-custom-release.sh
index 20ef4e371..95e88dec3 100755
--- a/scripts/update-custom-release.sh
+++ b/scripts/update-custom-release.sh
@@ -309,6 +309,7 @@ sign_and_validate_darwin_binary() {
 		fi
 		security find-identity -v -p codesigning "$CUSTOM_RELEASE_KEYCHAIN_PATH"
 		security find-identity -v -p codesigning
+		codesign_args+=(--keychain "$CUSTOM_RELEASE_KEYCHAIN_PATH")
 	fi
 	codesign_args+=(--options runtime --timestamp)
 	codesign "${codesign_args[@]}" "$binary"