diff --git a/.github/workflows/sign-exp13-windows.yml b/.github/workflows/sign-exp13-windows.yml
new file mode 100644
index 00000000..2ba9ff41
--- /dev/null
+++ b/.github/workflows/sign-exp13-windows.yml
@@ -0,0 +1,80 @@
+name: Sign locally built exp.13 Windows package
+
+on:
+  workflow_dispatch:
+    inputs:
+      payload_sha256:
+        description: SHA256 of the reviewed local Windows package
+        required: true
+        type: string
+      tools_sha256:
+        description: SHA256 of the reviewed signing scripts
+        required: true
+        type: string
+
+permissions:
+  contents: write
+
+concurrency:
+  group: exp13-windows-signing
+  cancel-in-progress: false
+
+jobs:
+  sign:
+    if: github.repository == 'openswarm-ai/openswarm'
+    runs-on: windows-latest
+    timeout-minutes: 45
+    env:
+      GH_TOKEN: ${{ github.token }}
+      EXPECTED_PAYLOAD_SHA: ${{ inputs.payload_sha256 }}
+      EXPECTED_TOOLS_SHA: ${{ inputs.tools_sha256 }}
+      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+      AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
+      AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
+      AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
+      AZURE_SIGNING_CERT_PROFILE: ${{ secrets.AZURE_SIGNING_CERT_PROFILE }}
+      EVS_ACCOUNT_NAME: ${{ secrets.EVS_ACCOUNT_NAME }}
+      EVS_PASSWD: ${{ secrets.EVS_PASSWD }}
+    steps:
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20.18.1
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'
+      - name: Verify and unpack the local build
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          if ($env:EXPECTED_PAYLOAD_SHA -notmatch '^[a-f0-9]{64}$' -or $env:EXPECTED_TOOLS_SHA -notmatch '^[a-f0-9]{64}$') { throw 'Invalid expected digest' }
+          $release = gh release view v1.7.10-exp.13 --repo openswarm-ai/openswarm --json isDraft | ConvertFrom-Json
+          if ($LASTEXITCODE -ne 0 -or -not $release.isDraft) { throw 'Expected unpublished exp.13 draft' }
+          New-Item -ItemType Directory incoming | Out-Null
+          gh release download v1.7.10-exp.13 --repo openswarm-ai/openswarm --pattern exp13-windows-unpacked.zip --pattern exp13-windows-signing-tools.zip --dir incoming
+          if ($LASTEXITCODE -ne 0) { throw 'Cannot download reviewed inputs' }
+          if ((Get-FileHash incoming/exp13-windows-unpacked.zip -Algorithm SHA256).Hash.ToLowerInvariant() -ne $env:EXPECTED_PAYLOAD_SHA) { throw 'Payload digest mismatch' }
+          if ((Get-FileHash incoming/exp13-windows-signing-tools.zip -Algorithm SHA256).Hash.ToLowerInvariant() -ne $env:EXPECTED_TOOLS_SHA) { throw 'Signing tools digest mismatch' }
+          Expand-Archive incoming/exp13-windows-unpacked.zip payload
+          Expand-Archive incoming/exp13-windows-signing-tools.zip signing
+      - name: Install pinned signing tools
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          python -m pip install castlabs-evs==1.3.2
+          if ($LASTEXITCODE -ne 0) { throw 'Cannot install Widevine signing tool' }
+          nuget install Microsoft.Trusted.Signing.Client -Version 1.0.60 -OutputDirectory trusted-signing -ExcludeVersion
+          if ($LASTEXITCODE -ne 0) { throw 'Cannot install Microsoft signing tool' }
+          $dlib = Join-Path $PWD 'trusted-signing/Microsoft.Trusted.Signing.Client/bin/x64/Azure.CodeSigning.Dlib.dll'
+          if (-not (Test-Path $dlib)) { throw 'Signing library missing' }
+          "AZURE_SIGNING_DLIB=$dlib" | Out-File $env:GITHUB_ENV -Append -Encoding utf8
+          $signtool = Get-ChildItem 'C:/Program Files (x86)/Windows Kits/10/bin' -Filter signtool.exe -Recurse | Where-Object { $_.FullName -match '\\x64\\signtool\.exe$' } | Sort-Object FullName -Descending | Select-Object -First 1
+          if (-not $signtool) { throw 'Windows SDK signing tool missing' }
+          "SIGNTOOL_PATH=$($signtool.FullName)" | Out-File $env:GITHUB_ENV -Append -Encoding utf8
+          Set-Location signing
+          npm ci --no-audit --no-fund
+          if ($LASTEXITCODE -ne 0) { throw 'Cannot install pinned packaging tools' }
+      - name: Sign, verify, package and upload to the existing draft
+        shell: pwsh
+        working-directory: signing
+        run: ./sign-package.ps1