diff --git a/pkgs/by-name/bi/bitwarden-desktop/package.nix b/pkgs/by-name/bi/bitwarden-desktop/package.nix
index 3dfd2513b7ee..5bbbbae658e8 100644
--- a/pkgs/by-name/bi/bitwarden-desktop/package.nix
+++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix
@@ -95,9 +95,6 @@ buildNpmPackage rec {
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
-  # make electron-builder not attempt to codesign the app on darwin
-  env.CSC_IDENTITY_AUTO_DISCOVERY = "false";
-
   nativeBuildInputs = [
     cargo
     dart-sass
diff --git a/pkgs/by-name/dr/drawio/package.nix b/pkgs/by-name/dr/drawio/package.nix
index f93da550e2cd..a494d80edfeb 100644
--- a/pkgs/by-name/dr/drawio/package.nix
+++ b/pkgs/by-name/dr/drawio/package.nix
@@ -64,19 +64,18 @@ stdenv.mkDerivation (finalAttrs: {
   buildPhase = ''
     runHook preBuild
 
-  ''
-  + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    cp -R ${electron.dist}/Electron.app Electron.app
-    chmod -R u+w Electron.app
-    export CSC_IDENTITY_AUTO_DISCOVERY=false
+    electron_dist="$(mktemp -d)"
+    cp -r ${electron.dist}/. "$electron_dist"
+    chmod -R u+w "$electron_dist"
+
     sed -i "/afterSign/d" electron-builder-linux-mac.json
-  ''
-  + ''
+
     npm exec electron-builder -- \
       --dir \
-      ${lib.optionalString stdenv.hostPlatform.isDarwin "--config electron-builder-linux-mac.json --config.mac.identity=null"} \
-      -c.electronDist=${if stdenv.hostPlatform.isDarwin then "." else electron.dist} \
-      -c.electronVersion=${electron.version}
+      --config electron-builder-linux-mac.json \
+      -c.electronDist="$electron_dist" \
+      -c.electronVersion=${electron.version} \
+      -c.mac.identity=null
 
     runHook postBuild
   '';
diff --git a/pkgs/by-name/gr/gridtracker2/package.nix b/pkgs/by-name/gr/gridtracker2/package.nix
index aba9890cff20..338ec428b897 100644
--- a/pkgs/by-name/gr/gridtracker2/package.nix
+++ b/pkgs/by-name/gr/gridtracker2/package.nix
@@ -50,28 +50,20 @@ buildNpmPackage (finalAttrs: {
 
   buildPhase = ''
     runHook preBuild
-  ''
-  + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # electronDist needs to be modifiable on Darwin
-    cp -r ${electron.dist} electron-dist
-    chmod -R u+w electron-dist
 
-    # Disable code signing during build on macOS.
-    # https://github.com/electron-userland/electron-builder/blob/fa6fc16/docs/code-signing.md#how-to-disable-code-signing-during-the-build-process-on-macos
-    export CSC_IDENTITY_AUTO_DISCOVERY=false
+    # the electronDist directory needs to be outside of the working directory
+    # otherwise the electron-builder config accidentally includes it inside the .asar file
+    electron_dist="$(mktemp -d)"
+    cp -r ${electron.dist}/. "$electron_dist"
+    chmod -R u+w "$electron_dist"
 
     npm exec electron-builder -- \
       --dir \
-      -c.electronDist=electron-dist \
-      -c.electronVersion=${electron.version}
-  ''
-  + lib.optionalString stdenv.hostPlatform.isLinux ''
-    npm exec electron-builder -- \
-      --dir \
-      -c.electronDist=${electron.dist} \
-      -c.electronVersion=${electron.version}
-  ''
-  + ''
+      -c.electronDist="$electron_dist" \
+      -c.electronVersion=${electron.version} \
+      -c.mac.identity=null
+    # ^ disable codesigning on Darwin
+
     runHook postBuild
   '';
 
diff --git a/pkgs/by-name/ka/kando/package.nix b/pkgs/by-name/ka/kando/package.nix
index 86a4d4d372f8..d4963a5d5eeb 100644
--- a/pkgs/by-name/ka/kando/package.nix
+++ b/pkgs/by-name/ka/kando/package.nix
@@ -69,8 +69,6 @@ buildNpmPackage.override { inherit nodejs; } rec {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     # use our own node headers since we skip downloading them
     NIX_CFLAGS_COMPILE = "-I${nodejs}/include/node";
-    # disable code signing on Darwin
-    CSC_IDENTITY_AUTO_DISCOVERY = lib.optionalString stdenv.hostPlatform.isDarwin "false";
   };
 
   postConfigure = ''
diff --git a/pkgs/by-name/mq/mqtt-explorer/package.nix b/pkgs/by-name/mq/mqtt-explorer/package.nix
index 1f09774684f6..8471ece5d4a7 100644
--- a/pkgs/by-name/mq/mqtt-explorer/package.nix
+++ b/pkgs/by-name/mq/mqtt-explorer/package.nix
@@ -56,12 +56,6 @@ stdenv.mkDerivation rec {
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
-  # disable code signing on macos
-  # https://github.com/electron-userland/electron-builder/blob/77f977435c99247d5db395895618b150f5006e8f/docs/code-signing.md#how-to-disable-code-signing-during-the-build-process-on-macos
-  postConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    export CSC_IDENTITY_AUTO_DISCOVERY=false
-  '';
-
   configurePhase = ''
     runHook preConfigure
 
@@ -100,7 +94,9 @@ stdenv.mkDerivation rec {
 
     yarn --offline run electron-builder --dir \
       -c.electronDist="$electron_dist" \
-      -c.electronVersion=${electron.version}
+      -c.electronVersion=${electron.version} \
+      -c.mac.identity=null
+    # ^ disable code signing on macos
 
     runHook postBuild
   '';
diff --git a/pkgs/by-name/op/opencode-desktop/package.nix b/pkgs/by-name/op/opencode-desktop/package.nix
index 2af9b61a87bb..87b15e49ed0d 100644
--- a/pkgs/by-name/op/opencode-desktop/package.nix
+++ b/pkgs/by-name/op/opencode-desktop/package.nix
@@ -54,12 +54,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     OPENCODE_CHANNEL = "prod";
     MODELS_DEV_API_JSON = "${models-dev}/dist/_api.json";
     OPENCODE_DISABLE_MODELS_FETCH = true;
-  }
-  # Disable code signing on macOS. Public build hosts don't have Apple Developer
-  # certificates, so electron-builder's `security find-identity` spawns produce
-  # EPERM inside the nix sandbox.
-  // lib.optionalAttrs stdenvNoCC.hostPlatform.isDarwin {
-    CSC_IDENTITY_AUTO_DISCOVERY = "false";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/si/signal-desktop/package.nix b/pkgs/by-name/si/signal-desktop/package.nix
index d84055a39297..de8764171560 100644
--- a/pkgs/by-name/si/signal-desktop/package.nix
+++ b/pkgs/by-name/si/signal-desktop/package.nix
@@ -181,10 +181,6 @@ stdenv.mkDerivation (finalAttrs: {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     SIGNAL_ENV = "production";
     SOURCE_DATE_EPOCH = 1780508208;
-  }
-  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # Disable code signing during local macOS builds.
-    CSC_IDENTITY_AUTO_DISCOVERY = "false";
   };
 
   preBuild = ''
diff --git a/pkgs/by-name/su/super-productivity/package.nix b/pkgs/by-name/su/super-productivity/package.nix
index 9584cc17b9c7..77f6c9bd3525 100644
--- a/pkgs/by-name/su/super-productivity/package.nix
+++ b/pkgs/by-name/su/super-productivity/package.nix
@@ -78,7 +78,6 @@ buildNpmPackage rec {
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     CHROMEDRIVER_SKIP_DOWNLOAD = "true";
-    CSC_IDENTITY_AUTO_DISCOVERY = "false";
   };
 
   nativeBuildInputs = [ copyDesktopItems ];
diff --git a/pkgs/by-name/te/teams-for-linux/package.nix b/pkgs/by-name/te/teams-for-linux/package.nix
index d6c919d4c068..6533308cff6b 100644
--- a/pkgs/by-name/te/teams-for-linux/package.nix
+++ b/pkgs/by-name/te/teams-for-linux/package.nix
@@ -37,11 +37,7 @@ buildNpmPackage rec {
 
   doInstallCheck = stdenv.hostPlatform.isLinux;
 
-  env = {
-    # disable code signing on Darwin
-    CSC_IDENTITY_AUTO_DISCOVERY = "false";
-    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
-  };
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
   makeCacheWritable = true;
 
diff --git a/pkgs/by-name/vo/voicevox/package.nix b/pkgs/by-name/vo/voicevox/package.nix
index e40181d50996..49346e310642 100644
--- a/pkgs/by-name/vo/voicevox/package.nix
+++ b/pkgs/by-name/vo/voicevox/package.nix
@@ -86,9 +86,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
-  # disable code signing on Darwin
-  env.CSC_IDENTITY_AUTO_DISCOVERY = "false";
-
   buildPhase = ''
     runHook preBuild
 
@@ -106,7 +103,9 @@ stdenv.mkDerivation (finalAttrs: {
       --dir \
       --config ./build/electronBuilderConfigLoader.cjs \
       -c.electronDist=electron-dist \
-      -c.electronVersion=${electron.version}
+      -c.electronVersion=${electron.version} \
+      -c.mac.identity=null
+    # ^ disable codesigning on Darwin
 
     runHook postBuild
   '';