diff --git a/electron/build/after-pack.js b/electron/build/after-pack.js
index 1baaa072..f6b5177e 100644
--- a/electron/build/after-pack.js
+++ b/electron/build/after-pack.js
@@ -45,7 +45,8 @@ function signVmp(context) {
     console.log(`[afterPack] VMP-signing ${target}`);
     // Creds go via the environment (EVS reads EVS_ACCOUNT_NAME/EVS_PASSWD), never on
     // the argv — a password in a command line is readable by any `ps` on the host.
-    execFileSync(py, ['-m', 'castlabs_evs.vmp', 'sign-pkg', target, '--no-ask'], {
+    // --no-ask is a GLOBAL castlabs flag; it must precede the subcommand or vmp.py rejects it (killed the first 1.5.5 release run).
+    execFileSync(py, ['-m', 'castlabs_evs.vmp', '--no-ask', 'sign-pkg', target], {
       stdio: 'inherit',
       env: { ...process.env, EVS_ACCOUNT_NAME: acct, EVS_PASSWD: pass },
     });
diff --git a/electron/scripts/sign-vmp.sh b/electron/scripts/sign-vmp.sh
index a96fdaa7..56badf84 100755
--- a/electron/scripts/sign-vmp.sh
+++ b/electron/scripts/sign-vmp.sh
@@ -57,7 +57,7 @@ if echo "$VERIFY_OUTPUT" | grep -q "Signature is valid" && ! echo "$VERIFY_OUTPU
 fi
 
 echo "[vmp] Signing Electron with production VMP certificate..."
-if python3 -m castlabs_evs.vmp sign-pkg "$ELECTRON_DIR" "${EVS_AUTH[@]}" 2>&1; then
+if python3 -m castlabs_evs.vmp "${EVS_AUTH[@]}" sign-pkg "$ELECTRON_DIR" 2>&1; then
   echo "[vmp] VMP signing successful — full DRM playback enabled"
   # Re-fix symlinks in case signing modified the bundle
   fix_framework_symlinks