diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index af14e4e88..ebded0869 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -404,16 +404,6 @@ jobs:
           path: temp_macos/Rune-${{ github.ref_name }}${{ github.event_name == 'workflow_dispatch' && format('-{0}', steps.short-sha.outputs.sha) || '' }}-macOS.zip
           name: Rune-${{ github.ref_name }}${{ github.event_name == 'workflow_dispatch' && format('-{0}', steps.short-sha.outputs.sha) || '' }}-macOS.zip
 
-      - name: Clean up
-        if: ${{ always() }}
-        run: |
-          just macos-ci-clean
-          if [ -f "$RUNNER_TEMP/rune-signing.keychain-db" ]; then
-            echo "$RUNNER_TEMP/rune-signing.keychain-db"
-            security delete-keychain $RUNNER_TEMP/rune-signing.keychain-db
-          fi
-          rm -f .env
-
       - name: Release DMG
         uses: ncipollo/release-action@v1
         if: startsWith(github.ref, 'refs/tags/v')
@@ -434,6 +424,16 @@ jobs:
           omitBodyDuringUpdate: true
           makeLatest: true
 
+      - name: Clean up
+        if: ${{ always() }}
+        run: |
+          just macos-ci-clean
+          if [ -f "$RUNNER_TEMP/rune-signing.keychain-db" ]; then
+            echo "$RUNNER_TEMP/rune-signing.keychain-db"
+            security delete-keychain $RUNNER_TEMP/rune-signing.keychain-db
+          fi
+          rm -f .env
+
   build-and-release-mac-app-store:
     runs-on: macos-latest
     if: startsWith(github.ref, 'refs/tags/v')