diff --git a/.github/workflows/build_viewer.yml b/.github/workflows/build_viewer.yml
index 7d22ea5696..41c7e34994 100644
--- a/.github/workflows/build_viewer.yml
+++ b/.github/workflows/build_viewer.yml
@@ -302,28 +302,19 @@ jobs:
           autobuild configure -c ReleaseFS -A${addrsize} -- --package --chan ${{env.FS_RELEASE_CHAN}} ${{env.EXTRA_ARGS}} ${{env.FS_GRID}}
           echo "BUGSPLAT_DB=$BUGSPLAT_DB" >> $GITHUB_ENV
         shell: bash
-      - name: Setup env for code signing on windows
-        if: runner.os == 'Windows'
-        run: |
-          echo "FS_CERT=${{ secrets.FS_CERT }}" >> $GITHUB_ENV
-          echo "FS_CERT_PASS=${{ secrets.FS_CERT_PASS }}" >> $GITHUB_ENV
       - name: Generate metadata.json
+        if: runner.os == 'Windows'
         run: |
           echo '{
-          "Endpoint": "${{ secrets.AZURE_ENDPOINT }}",
-          "CodeSigningAccountName": "${{ secrets.AZURE_CODE_SIGNING_NAME }}",
-          "CertificateProfileName": "${{ secrets.AZURE_CERT_PROFILE_NAME }}",
-          "ExcludeCredentials": [
-            "ManagedIdentityCredential"
-          ]
-          }' > ${{github.workspace}}/metadata.json
-      - name: Prime the env for trusted code support
-        if: runner.os == 'Windows'
-        run: |
-          echo "AZURE_CLIENT_ID=${{ secrets.AZURE_CLIENT_ID }}" >> $GITHUB_ENV
-          echo "AZURE_CLIENT_SECRET=${{ secrets.AZURE_CLIENT_SECRET }}" >> $GITHUB_ENV
-          echo "AZURE_TENANT_ID=${{ secrets.AZURE_TENANT_ID }}" >> $GITHUB_ENV
-          echo "CODESIGNING_METADATA_PATH=${{github.workspace}}/metadata.json" >> $GITHUB_ENV
+            "Endpoint": "${{ secrets.AZURE_ENDPOINT }}",
+            "CodeSigningAccountName": "${{ secrets.AZURE_CODE_SIGNING_NAME }}",
+            "CertificateProfileName": "${{ secrets.AZURE_CERT_PROFILE_NAME }}",
+            "ExcludeCredentials": [
+              "ManagedIdentityCredential"
+              ]
+            }' > ${{github.workspace}}/metadata.json
+          echo "CODESIGNING_METADATA_PATH=${{github.workspace}}/metadata.json" >> $GITHUB_ENV            
+        shell: bash
       - name: Validate Windows 10 SDK version and find signtool.exe
         if: runner.os == 'Windows'
         id: validate-sdk
@@ -376,6 +367,13 @@ jobs:
           }
           echo "CODESIGNING_DLIB_PATH=$dllPath" >> $env:GITHUB_ENV
         shell: pwsh
+      - name: Prep env for Trusted code on Windows only
+        if: runner.os == 'Windows'
+        run: |
+          echo "AZURE_CLIENT_ID=${{ secrets.AZURE_CLIENT_ID }}" >> $GITHUB_ENV
+          echo "AZURE_CLIENT_SECRET=${{ secrets.AZURE_CLIENT_SECRET }}" >> $GITHUB_ENV
+          echo "AZURE_TENANT_ID=${{ secrets.AZURE_TENANT_ID }}" >> $GITHUB_ENV
+        shell: bash
       - name: build
         id: build
         run: autobuild build -c ReleaseFS -A${addrsize} --no-configure