diff --git a/packaging/macos/import-cert.sh b/packaging/macos/import-cert.sh
index a2af5fb49c..de16f22d43 100755
--- a/packaging/macos/import-cert.sh
+++ b/packaging/macos/import-cert.sh
@@ -24,7 +24,9 @@ KEYCHAIN="$TMP/pdfcraft-signing.keychain-db"
 CERT="$TMP/pdfcraft-signing.p12"
 KC_PASS="${KEYCHAIN_PASSWORD:-$(openssl rand -hex 24)}"
 
-trap 'rm -f "$CERT"' EXIT
+# Every exit path removes the keychain and the folder holding it: the keychain keeps the signing
+# identity, and each run makes a new folder under a temporary parent that can outlive the job.
+trap 'rm -f "$CERT"; security delete-keychain "$KEYCHAIN" 2>/dev/null || true; rm -rf "$TMP"' EXIT
 printf '%s' "$APPLE_CERTIFICATE" | base64 --decode >"$CERT"
 security create-keychain -p "$KC_PASS" "$KEYCHAIN"
 security set-keychain-settings -lut 21600 "$KEYCHAIN"