diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index dc15139..c320870 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -407,7 +407,9 @@ jobs:
           set -euo pipefail
           sudo apt-get update
           sudo apt-get install -y default-jre-headless
-          JSIGN_VERSION="6.0"
+          # jsign >= 7.0 is required for the TRUSTEDSIGNING (Azure Trusted Signing) storetype;
+          # 6.0 only supports AZUREKEYVAULT. 7.1 matches the version on the build host.
+          JSIGN_VERSION="7.1"
           curl -fsSL "https://github.com/ebourg/jsign/releases/download/${JSIGN_VERSION}/jsign-${JSIGN_VERSION}.jar" \
             -o /tmp/jsign.jar
           echo "[OK] Installed JRE and jsign ${JSIGN_VERSION}"