diff --git a/.github/workflows/signpath_sign.yml b/.github/workflows/signpath_sign.yml
index 7f3f3dd0..e02132c2 100644
--- a/.github/workflows/signpath_sign.yml
+++ b/.github/workflows/signpath_sign.yml
@@ -13,7 +13,7 @@ on:
         default: test-signing
 
 permissions:
-  actions: read   # the SignPath action downloads the uploaded artifact through the GitHub API
+  actions: write  # SignPath downloads the unsigned artifacts through the API; the last step deletes them
   contents: read
 
 jobs:
@@ -125,3 +125,15 @@ jobs:
             bin/SftpFileSystem.x86.*.zip
             bin/chocolatey/logexpert.*.nupkg
           retention-days: 7
+
+      # Leaves only the signed artifact, so the unsigned installer cannot be downloaded by mistake.
+      # Skipped when an earlier step failed, so the unsigned files stay available for debugging.
+      - name: Delete unsigned artifacts
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          foreach ($id in '${{ steps.upload-unsigned-app.outputs.artifact-id }}', '${{ steps.upload-unsigned-setup.outputs.artifact-id }}') {
+            gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/$id"
+            if ($LASTEXITCODE -ne 0) { exit 1 }
+          }
diff --git a/README.md b/README.md
index 74aa32e5..6e764f2d 100644
--- a/README.md
+++ b/README.md
@@ -39,6 +39,19 @@ Requirements
 * <https://dotnet.microsoft.com/en-us/download>
 * .NET 10 (<https://dotnet.microsoft.com/en-us/download/dotnet/thank-you/runtime-desktop-10.0.0-windows-x64-installer>)
 
+## Code signing policy
+
+Free code signing provided by [SignPath.io](https://about.signpath.io), certificate by [SignPath Foundation](https://signpath.org)
+
+Only LogExpert's own binaries are signed. Third-party libraries shipped with LogExpert are not signed by this project.
+
+Team roles:
+
+* Committers and reviewers: [Hirogen](https://github.com/Hirogen)
+* Approvers: [Hirogen](https://github.com/Hirogen)
+
+Privacy policy: This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it. For example, the SFTP plugin only connects to the servers the user opens files from.
+
 ## Command line
 
 Open a log at a specific line:
diff --git a/build/Build.cs b/build/Build.cs
index 463883e8..eda443f2 100644
--- a/build/Build.cs
+++ b/build/Build.cs
@@ -269,7 +269,9 @@ protected override void OnBuildInitialized()
                 .SetProject(columnizerFolder / "ColumnizerLib.csproj")
                 .SetConfiguration(Configuration)
                 .SetOutputDirectory(BinDirectory)
-                .SetVersion(VersionString));
+                .SetVersion(VersionString)
+                // Directory.Build.props pins PackageVersion, which would otherwise win over Version.
+                .SetProperty("PackageVersion", VersionString));
         });
 
     Target Pack => _ => _
diff --git a/src/docs/CODE_SIGNING.md b/src/docs/CODE_SIGNING.md
index 61f355a4..281caa5e 100644
--- a/src/docs/CODE_SIGNING.md
+++ b/src/docs/CODE_SIGNING.md
@@ -104,7 +104,8 @@ logs.
 3. The run should:
    - print a table of signed binaries in *Check binary signatures*. With the test certificate the
      status is `UnknownError` (untrusted root), not `Valid`. That is expected.
-   - finish with a `signed-packages-test-signing` artifact.
+   - finish with a `signed-packages-test-signing` artifact. The two unsigned artifacts are deleted
+     at the end of a successful run, and kept when a step fails, so they can be inspected.
 4. Download the artifact, right-click `LogExpert-Setup-*.exe` → *Properties* → *Digital Signatures*.
    A signature from the SignPath test certificate should be listed.
 5. Install it and make sure LogExpert starts **and the built-in columnizers load**. This confirms