diff --git a/.github/workflows/windows-build.yml b/.github/workflows/windows-build.yml
index d663bd0..1c902c0 100644
--- a/.github/workflows/windows-build.yml
+++ b/.github/workflows/windows-build.yml
@@ -32,9 +32,10 @@ jobs:
       - name: Build test-signed MSIX installer
         shell: pwsh
         run: |
-          $directory = Join-Path $env:RUNNER_TEMP 'smm-test-signing'
-          $password = [Convert]::ToBase64String([Security.Cryptography.RandomNumberGenerator]::GetBytes(24))
-          ./build/windows/New-TestSigningCertificate.ps1 -OutputDirectory $directory -Password $password
+            $directory = Join-Path $env:RUNNER_TEMP 'smm-test-signing'
+            $password = [Convert]::ToBase64String([Security.Cryptography.RandomNumberGenerator]::GetBytes(24))
+            Write-Output "::add-mask::$password"
+            ./build/windows/New-TestSigningCertificate.ps1 -OutputDirectory $directory -Password $password
           ./build/windows/Build-Installer.ps1 `
             -CertificatePath (Join-Path $directory 'server-monitor-manager-test-signing.pfx') `
             -CertificatePassword $password
diff --git a/.github/workflows/windows-release.yml b/.github/workflows/windows-release.yml
index 9e1dc96..5cfdeaa 100644
--- a/.github/workflows/windows-release.yml
+++ b/.github/workflows/windows-release.yml
@@ -31,6 +31,7 @@ jobs:
           $directory = Join-Path $env:RUNNER_TEMP 'smm-signing'
           New-Item -ItemType Directory -Path $directory -Force | Out-Null
           if ($env:SIGNING_CERTIFICATE_BASE64 -and $env:SIGNING_CERTIFICATE_PASSWORD) {
+            Write-Output "::add-mask::$env:SIGNING_CERTIFICATE_PASSWORD"
             $pfx = Join-Path $directory 'trusted-signing.pfx'
             [IO.File]::WriteAllBytes($pfx, [Convert]::FromBase64String($env:SIGNING_CERTIFICATE_BASE64))
             "certificate=$pfx" >> $env:GITHUB_OUTPUT
@@ -38,6 +39,7 @@ jobs:
             "test_certificate=false" >> $env:GITHUB_OUTPUT
           } else {
             $password = [Convert]::ToBase64String([Security.Cryptography.RandomNumberGenerator]::GetBytes(24))
+            Write-Output "::add-mask::$password"
             ./build/windows/New-TestSigningCertificate.ps1 -OutputDirectory $directory -Password $password
             "certificate=$(Join-Path $directory 'server-monitor-manager-test-signing.pfx')" >> $env:GITHUB_OUTPUT
             "public_certificate=$(Join-Path $directory 'server-monitor-manager-test-signing.cer')" >> $env:GITHUB_OUTPUT
diff --git a/build/windows/Build-Installer.ps1 b/build/windows/Build-Installer.ps1
index 87eab97..2092665 100644
--- a/build/windows/Build-Installer.ps1
+++ b/build/windows/Build-Installer.ps1
@@ -35,7 +35,7 @@ try {
         throw "The certificate subject must match Package.appxmanifest Publisher=CN=AppPublisher; actual: $($signingCertificate.Subject)"
     }
 
-    dotnet restore $project -r win-x64 -p:Platform=x64
+    dotnet restore $project -r win-x64 -p:Platform=x64 -p:PublishReadyToRun=false
     if ($LASTEXITCODE -ne 0) { throw 'dotnet restore failed' }
 
     dotnet publish $project `
@@ -43,6 +43,7 @@ try {
         --runtime win-x64 `
         --no-restore `
         -p:Platform=x64 `
+        -p:PublishReadyToRun=false `
         -p:GenerateAppxPackageOnBuild=true `
         -p:AppxPackageSigningEnabled=true `
         -p:PackageCertificateThumbprint=$($signingCertificate.Thumbprint) `