diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 73992e4..1c7a65d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -58,11 +58,8 @@ jobs:
         with:
           global-json-file: global.json
 
-      - name: Publish agent
-        run: >
-          dotnet publish src/HaActiveUser.Agent/HaActiveUser.Agent.csproj
-          -c Release -r win-x64 --self-contained false
-          -p:PublishSingleFile=true -p:DebugType=None
+      - name: Publish agents
+        run: pwsh ./build/publish-agent.ps1 -SkipInstaller
 
       - name: Azure login
         if: env.SIGNING_ENABLED == 'true'
@@ -72,7 +69,7 @@ jobs:
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
           subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
-      # Signed before the MSI is built so the packaged copy carries the signature.
+      # Signed before the MSI is built so the packaged copies carry the signatures.
       - name: Sign agent
         if: env.SIGNING_ENABLED == 'true'
         uses: azure/artifact-signing-action@208f8af4bf26cf2af8597424e3cb5582801523ba # v2.0.0
@@ -87,6 +84,18 @@ jobs:
           timestamp-rfc3161: http://timestamp.acs.microsoft.com
           timestamp-digest: SHA256
 
+      - name: Sign session agent
+        if: env.SIGNING_ENABLED == 'true'
+        uses: azure/artifact-signing-action@208f8af4bf26cf2af8597424e3cb5582801523ba # v2.0.0
+        with:
+          endpoint: ${{ vars.AZURE_SIGNING_ENDPOINT }}
+          signing-account-name: ${{ vars.AZURE_SIGNING_ACCOUNT }}
+          certificate-profile-name: ${{ vars.AZURE_SIGNING_PROFILE }}
+          files: ${{ github.workspace }}\src\HaActiveUser.SessionAgent\bin\Release\net8.0-windows\win-x64\publish\HaActiveUser.SessionAgent.exe
+          file-digest: SHA256
+          timestamp-rfc3161: http://timestamp.acs.microsoft.com
+          timestamp-digest: SHA256
+
       - name: Build MSI
         run: dotnet build installer/HaActiveUser.Installer.wixproj -c Release