diff --git a/codemagic.yaml b/codemagic.yaml
index 45111b5..7db3390 100644
--- a/codemagic.yaml
+++ b/codemagic.yaml
@@ -23,6 +23,8 @@ workflows:
       # a brand-new app it fails init with "No matching profiles found …". Instead the "Set up code
       # signing" script below runs `fetch-signing-files … --create`, which creates the distribution
       # certificate + profile on first run, then `xcode-project use-profiles` wires them into the project.
+      groups:
+        - ios_signing   # ← Codemagic variable group holding CERTIFICATE_PRIVATE_KEY (secure). See below.
       vars:
         BUNDLE_ID: "com.bizgaze.connect"
         XCODE_WORKSPACE: "mobile/ios/App/App.xcworkspace"
@@ -55,9 +57,17 @@ workflows:
           # cert to the keychain. NOTE: `xcode-project use-profiles` is intentionally NOT here — it must
           # run AFTER `pod install` generates the workspace, otherwise it fails to wire the profile into
           # the App target and the archive dies with "App requires a provisioning profile".
+          #
+          # --certificate-key is REQUIRED for reusable signing: without it, --create makes a throwaway
+          # distribution cert whose private key dies with the build machine, so the next build finds a
+          # cert it has no key for ("Cannot save Signing Certificates without certificate private key").
+          # By passing our own fixed private key (CERTIFICATE_PRIVATE_KEY, a secure var in the
+          # `ios_signing` group), the cert is created once from that key and reused by every build.
           keychain initialize
           app-store-connect fetch-signing-files "$BUNDLE_ID" \
-            --type IOS_APP_STORE --create
+            --type IOS_APP_STORE \
+            --certificate-key="@env:CERTIFICATE_PRIVATE_KEY" \
+            --create
           keychain add-certificates
 
       - name: Install CocoaPods