diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2d06e05c6..7da72cfe2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -225,7 +225,7 @@ jobs:
         with:
           package_manager: npm
           skip_package_manager_install: true
-          args: --publish onTagOrDraft # attach signed binaries to an existing release draft or when a tag is merged
+          args: --publish onTagOrDraft ${{ matrix.os == 'macos-latest' && '-c.afterSign=./pkgs/macos/notarize-build.js' || '' }} # attach signed binaries to an existing release draft or when a tag is merged
           release: false # keep github release as draft for manual inspection
           max_attempts: 2
           # GH token for attaching atrifacts to release draft on tag build
@@ -262,4 +262,3 @@ jobs:
 
       - name: Show Cache
         run: du -sh ${{ github.workspace }}/.cache/ && ls -l ${{ github.workspace }}/.cache/
-
diff --git a/electron-builder.yml b/electron-builder.yml
index 8056280cb..ca12784ca 100644
--- a/electron-builder.yml
+++ b/electron-builder.yml
@@ -13,8 +13,6 @@ directories:
 
 asarUnpack: 'src/**/scripts/**/*'
 
-afterSign: './pkgs/macos/notarize-build.js'
-
 mac:
   artifactName: ${name}-${version}-squirrel.${ext}
   category: public.app-category.utilities
diff --git a/patches/app-builder-lib+26.8.1.patch b/patches/app-builder-lib+26.8.1.patch
index d9542c092..f6990f28d 100644
--- a/patches/app-builder-lib+26.8.1.patch
+++ b/patches/app-builder-lib+26.8.1.patch
@@ -1,3 +1,17 @@
+diff --git a/node_modules/app-builder-lib/out/node-module-collector/nodeModulesCollector.js b/node_modules/app-builder-lib/out/node-module-collector/nodeModulesCollector.js
+index 8160257..219dfd1 100644
+--- a/node_modules/app-builder-lib/out/node-module-collector/nodeModulesCollector.js
++++ b/node_modules/app-builder-lib/out/node-module-collector/nodeModulesCollector.js
+@@ -320,7 +320,8 @@ class NodeModulesCollector {
+             const child = childProcess.spawn(command, args, {
+                 cwd,
+                 env: { COREPACK_ENABLE_STRICT: "0", ...process.env }, // allow `process.env` overrides
+-                shell: true, // `true`` is now required: https://github.com/electron-userland/electron-builder/issues/9488
++                // Linux emits DEP0190 when args are passed with shell=true; we only need shell wrapping on Windows.
++                shell: process.platform === "win32", // https://github.com/electron-userland/electron-builder/issues/9488
+             });
+             let stderr = "";
+             child.stdout.pipe(outStream);
 diff --git a/node_modules/app-builder-lib/scheme.json b/node_modules/app-builder-lib/scheme.json
 index 2eadec7..d55eced 100644
 --- a/node_modules/app-builder-lib/scheme.json
diff --git a/src/index.js b/src/index.js
index 461fe7d71..0c84ce5fc 100644
--- a/src/index.js
+++ b/src/index.js
@@ -3,6 +3,20 @@ const { registerAppStartTime, getSecondsSinceAppStart } = require('./metrics/app
 registerAppStartTime()
 require('v8-compile-cache')
 
+const emitWarning = process.emitWarning.bind(process)
+process.emitWarning = (warning, ...args) => {
+  // Electron's ASAR shim currently triggers DEP0180 internally (asarStatsToFsStats).
+  // Filter this known upstream warning to keep runtime logs actionable.
+  const warningCode = (
+    (warning && typeof warning === 'object' && warning.code) ||
+    (args[0] && typeof args[0] === 'object' && args[0].code) ||
+    (typeof args[1] === 'string' && args[1]) ||
+    undefined
+  )
+  if (warningCode === 'DEP0180') return
+  return emitWarning(warning, ...args)
+}
+
 const { app, dialog } = require('electron')
 
 if (process.env.NODE_ENV === 'test') {