diff --git a/cmake/recipes_bootstrap.cmake b/cmake/recipes_bootstrap.cmake
index 590396f96..740d94d84 100644
--- a/cmake/recipes_bootstrap.cmake
+++ b/cmake/recipes_bootstrap.cmake
@@ -1,5 +1,6 @@
 find_program(CONAN_COMMAND "conan" REQUIRED
     HINTS
+		"${CMAKE_SOURCE_DIR}/.venv/Scripts"
         "${CMAKE_SOURCE_DIR}/.venv/bin"
         "/opt/homebrew/bin"
 )
diff --git a/cmake/sign_binaries.cmake b/cmake/sign_binaries.cmake
index c19c1d644..9903b5fe8 100644
--- a/cmake/sign_binaries.cmake
+++ b/cmake/sign_binaries.cmake
@@ -1,6 +1,9 @@
 if(NOT DEFINED SIGNTOOL_SUBJECT_NAME)
     set(SIGNTOOL_SUBJECT_NAME "$ENV{SIGNTOOL_SUBJECT_NAME}")
 endif()
+if(NOT DEFINED SIGNTOOL_CERT_HAS_UI)
+    set(SIGNTOOL_CERT_HAS_UI "$ENV{SIGNTOOL_CERT_HAS_UI}")
+endif()
 if(NOT DEFINED CODESIGN_SIGNATURE)
     set(CODESIGN_SIGNATURE "$ENV{CODESIGN_SIGNATURE}")
 endif()
@@ -9,14 +12,11 @@ if(NOT DEFINED CODESIGN_KEYCHAIN)
 endif()
 
 if(WIN32)
-    file(GLOB_RECURSE BINARIES
-        "${CPACK_TEMPORARY_DIRECTORY}/*.dll"
-        "${CPACK_TEMPORARY_DIRECTORY}/*.exe"
-    )
-
-    if(BINARIES AND SIGNTOOL_SUBJECT_NAME)
+	set(AMNEZIA_PACKAGE_DIR "${CPACK_TEMPORARY_DIRECTORY}/packages/AmneziaVPN/data")
+    if(SIGNTOOL_SUBJECT_NAME)
         include(${CMAKE_CURRENT_LIST_DIR}/util/signtool.cmake)
-        signtool_sign_files("${BINARIES}" "${SIGNTOOL_SUBJECT_NAME}")
+        signtool_sign_files("${AMNEZIA_PACKAGE_DIR}/*.exe" "${SIGNTOOL_SUBJECT_NAME}" "${SIGNTOOL_CERT_HAS_UI}")
+		signtool_sign_files("${AMNEZIA_PACKAGE_DIR}/*.dll" "${SIGNTOOL_SUBJECT_NAME}" "${SIGNTOOL_CERT_HAS_UI}")
     endif()
 endif()
 
diff --git a/cmake/sign_packages.cmake b/cmake/sign_packages.cmake
index c95ffc8e4..f99b2bcf7 100644
--- a/cmake/sign_packages.cmake
+++ b/cmake/sign_packages.cmake
@@ -1,6 +1,9 @@
 if(NOT DEFINED SIGNTOOL_SUBJECT_NAME)
     set(SIGNTOOL_SUBJECT_NAME "$ENV{SIGNTOOL_SUBJECT_NAME}")
 endif()
+if(NOT DEFINED SIGNTOOL_CERT_HAS_UI)
+    set(SIGNTOOL_CERT_HAS_UI "$ENV{SIGNTOOL_CERT_HAS_UI}")
+endif()
 if(NOT DEFINED NOTARYTOOL_EMAIL)
     set(NOTARYTOOL_EMAIL "$ENV{NOTARYTOOL_EMAIL}")
 endif()
@@ -15,7 +18,7 @@ if(WIN32)
     if (SIGNTOOL_SUBJECT_NAME)
         include(${CMAKE_CURRENT_LIST_DIR}/util/signtool.cmake)
         foreach(PACKAGE_FILE IN LISTS CPACK_PACKAGE_FILES)
-            signtool_sign_files("${PACKAGE_FILE}" "${SIGNTOOL_SUBJECT_NAME}")
+            signtool_sign_files("${PACKAGE_FILE}" "${SIGNTOOL_SUBJECT_NAME}" "${SIGNTOOL_CERT_HAS_UI}")
         endforeach()
     endif()
 endif()
diff --git a/cmake/util/signtool.cmake b/cmake/util/signtool.cmake
index fe62e083d..27aa9e166 100644
--- a/cmake/util/signtool.cmake
+++ b/cmake/util/signtool.cmake
@@ -1,10 +1,6 @@
 find_program(SIGNTOOL_COMMAND signtool REQUIRED)
 
-function(signtool_sign_files PACKAGE_FILES SUBJECT_NAME)
-    if(NOT SUBJECT_NAME)
-        set(SUBJECT_NAME "Privacy Technologies OU")
-    endif()
-
+function(signtool_sign_files PACKAGE_FILES SUBJECT_NAME CERT_HAS_UI)
     if(PACKAGE_FILES)
         set(args sign
             /n ${SUBJECT_NAME}
@@ -13,26 +9,33 @@ function(signtool_sign_files PACKAGE_FILES SUBJECT_NAME)
             /tr http://timestamp.comodoca.com/?td=sha256
         )
 
-        foreach(file IN LISTS PACKAGE_FILES)
-            set(local_args ${args})
-            if (NOT "${file}" MATCHES "\\.msi$")
-                list(APPEND local_args /as)
-            endif()
+		if (NOT "${PACKAGE_FILES}" MATCHES "\\.msi$")
+			list(APPEND args /as)
+		endif()
 
-            set(cmd ${SIGNTOOL_COMMAND} ${local_args} ${file})
+		set(cmd ${SIGNTOOL_COMMAND} ${args} ${PACKAGE_FILES})
 
-            list(JOIN cmd " " cmd_str)
-            message(STATUS "${cmd_str}")
+		list(JOIN cmd " " cmd_str)
+		message(STATUS "${cmd_str}")
 
-            execute_process(
+		if (CERT_HAS_UI)
+			execute_process(
+				COMMAND cmd /c start "" /wait ${cmd}
+				RESULT_VARIABLE result
+			)
+			if(NOT result EQUAL 0)
+				message(FATAL_ERROR "signtool failed with code ${result}")
+			endif()
+		else()
+			execute_process(
                 COMMAND ${cmd}
                 RESULT_VARIABLE result
                 ERROR_VARIABLE error
             )
-            if(NOT result EQUAL 0)
-                string(REPLACE "\n" "\n  " error "  ${error}")
-                message(FATAL_ERROR "signtool failed:\n${error}")
-            endif()
-        endforeach()
+			if(NOT result EQUAL 0)
+				string(REPLACE "\n" "\n  " error "  ${error}")
+				message(FATAL_ERROR "signtool failed:\n${error}")
+			endif()
+		endif()
     endif()
 endfunction()
diff --git a/deploy/build.bat b/deploy/build.bat
index 1ee07eaa0..6218e7843 100644
--- a/deploy/build.bat
+++ b/deploy/build.bat
@@ -10,6 +10,8 @@ if /i "%~1" == "-i"             set "ARG_BUILD_INSTALLERS=!ARG_BUILD_INSTALLERS!
 if /i "%~1" == "--installer"    set "ARG_BUILD_INSTALLERS=!ARG_BUILD_INSTALLERS! %~2" & shift
 if /i "%~1" == "-arch"          set "ARCH=%~2" & shift
 if /i "%~1" == "--architecture" set "ARCH=%~2" & shift
+if /i "%~1" == "--sign-cloud"   set "SIGNTOOL_SUBJECT_NAME=%~2" & shift
+if /i "%~1" == "--sign-phys"    set "SIGNTOOL_SUBJECT_NAME=%~2" & set "SIGNTOOL_CERT_HAS_UI=true" & shift
 shift
 goto :parse_args
 :done_args