diff --git a/.github/workflows/release-desktop.yml b/.github/workflows/release-desktop.yml
index 928360be..a73c078a 100644
--- a/.github/workflows/release-desktop.yml
+++ b/.github/workflows/release-desktop.yml
@@ -161,8 +161,10 @@ jobs:
       - name: Build signed macOS Electron release artifacts
         if: matrix.smoke_platform == 'macos' && needs.signing-preflight.outputs.macos_signed == 'true'
         working-directory: desktop
+        timeout-minutes: 45
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DEBUG: 'electron-builder,electron-osx-sign,electron-notarize*'
           # Signed macOS releases require all of these secrets. Keep this step
           # separate from the unsigned fallback so empty secrets are never passed
           # to electron-builder as CSC_LINK / APPLE_* env vars.
@@ -171,7 +173,19 @@ jobs:
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-        run: node ./node_modules/electron-builder/out/cli/cli.js ${{ matrix.builder_args }} --publish never
+        run: |
+          set -euo pipefail
+          echo "::group::macOS signing diagnostics"
+          echo "UTC start: $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
+          sw_vers
+          xcodebuild -version
+          xcrun --find notarytool
+          xcrun notarytool --version || true
+          security find-identity -v -p codesigning || true
+          echo "::endgroup::"
+          echo "Starting signed electron-builder at $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
+          node ./node_modules/electron-builder/out/cli/cli.js ${{ matrix.builder_args }} --publish never
+          echo "Finished signed electron-builder at $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
 
       - name: Build unsigned Electron release artifacts
         if: matrix.smoke_platform != 'macos' || needs.signing-preflight.outputs.macos_signed != 'true'
diff --git a/scripts/pr/release-workflow.test.ts b/scripts/pr/release-workflow.test.ts
index 952b1f56..3b7f27f2 100644
--- a/scripts/pr/release-workflow.test.ts
+++ b/scripts/pr/release-workflow.test.ts
@@ -129,6 +129,13 @@ describe('release desktop workflow', () => {
     expect(signedBuildStep).toContain('APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}')
     expect(signedBuildStep).toContain('APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}')
     expect(signedBuildStep).not.toContain('CSC_IDENTITY_AUTO_DISCOVERY')
+    expect(signedBuildStep).toContain('timeout-minutes: 45')
+    expect(signedBuildStep).toContain("DEBUG: 'electron-builder,electron-osx-sign,electron-notarize*'")
+    expect(signedBuildStep).toContain('macOS signing diagnostics')
+    expect(signedBuildStep).toContain('xcrun --find notarytool')
+    expect(signedBuildStep).toContain('security find-identity -v -p codesigning')
+    expect(signedBuildStep).toContain('Starting signed electron-builder')
+    expect(signedBuildStep).toContain('Finished signed electron-builder')
     expect(signedBuildStep).toContain(electronBuilderCli)
 
     expect(unsignedBuildStep).toContain("if: matrix.smoke_platform != 'macos' || needs.signing-preflight.outputs.macos_signed != 'true'")