diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 020eb1c00..314fcc2f0 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -2,6 +2,7 @@
 # SPDX-License-Identifier: MIT
 ---
 # https://docs.github.com/actions/learn-github-actions
+# https://github.com/actions/upload-artifact
 name: build
 on:
   push:
@@ -543,6 +544,33 @@ jobs:
             *-*-macos*.*
             urls.txt
 
+  win-llvm-from-mac:
+    runs-on: macos-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 8
+      - name: 'build'
+        env:
+          CW_LLVM_MINGW_DL: '1'
+          CW_LLVM_MINGW_ONLY: '0'
+        run: |
+          export CW_CONFIG='${{ github.ref_name }}-win'
+          export CW_REVISION='${{ github.sha }}'
+          . ./_versions.sh
+          sh -c ./_ci-mac-homebrew.sh
+
+      - name: 'list dependencies'
+        run: cat urls.txt
+      - uses: actions/upload-artifact@v4
+        with:
+          name: 'curl-windows-llvm-from-mac'
+          retention-days: 5
+          path: |
+            *-*-mingw*.*
+            urls.txt
+
   win-llvm:
     runs-on: ubuntu-latest
     timeout-minutes: 30
@@ -569,7 +597,6 @@ jobs:
 
       - name: 'list dependencies'
         run: cat urls.txt
-      # https://github.com/actions/upload-artifact
       - uses: actions/upload-artifact@v4
         with:
           name: 'curl-windows-llvm'
@@ -604,7 +631,6 @@ jobs:
 
       - name: 'list dependencies'
         run: cat urls.txt
-      # https://github.com/actions/upload-artifact
       - uses: actions/upload-artifact@v4
         with:
           name: 'curl-windows-gcc-noarm64'
diff --git a/_build.sh b/_build.sh
index 57c6fc218..e5b5838a8 100755
--- a/_build.sh
+++ b/_build.sh
@@ -452,7 +452,12 @@ fi
 
 if [ "${_OS}" = 'win' ] && \
    [ -s "${SIGN_CODE_KEY}" ]; then
-  osslsigncode --version  # We need 2.2 or newer
+  if command -v osslsigncode >/dev/null 2>&1; then
+    osslsigncode --version  # We need 2.2 or newer
+  elif [ -n "${SIGN_PKG_KEY_PASS:+1}" ]; then
+    unset SIGN_CODE_KEY_PASS
+    echo "! WARNING: osslsigncode not found, code signing disabled."
+  fi
 fi
 
 _ori_path="${PATH}"
diff --git a/_ci-linux-debian.sh b/_ci-linux-debian.sh
index 3a81a960d..f87de270f 100755
--- a/_ci-linux-debian.sh
+++ b/_ci-linux-debian.sh
@@ -21,7 +21,8 @@ fi
 [[ "${CW_CONFIG:-}" = *'boringssl'* ]] && extra+=' golang'
 
 if [[ "${CW_CONFIG:-}" = *'win'* ]]; then
-  extra+=' mingw-w64 osslsigncode wine64'
+  extra+=' mingw-w64 wine64'
+# extra+=' osslsigncode'
   if [[ "${CW_CONFIG:-}" = *'boringssl'* ]]; then
     extra+=' nasm'
   fi