diff --git a/src/main/updater.test.ts b/src/main/updater.test.ts
index b4c1a47c5..defad8588 100644
--- a/src/main/updater.test.ts
+++ b/src/main/updater.test.ts
@@ -1766,11 +1766,14 @@ describe('updater', () => {
     expect(setPendingUpdateNudgeId).toHaveBeenCalledWith(null)
   })
 
-  // Why: issue #631 — the Windows auto-updater fails because installed
-  // versions signed with the wrong certificate have a stale publisherName
-  // in app-update.yml. verifyUpdateCodeSignature must be overridden on
-  // Windows so electron-updater skips Authenticode verification.
-  it('overrides verifyUpdateCodeSignature on Windows to skip signing verification', async () => {
+  // Why: the Windows auto-updater must keep electron-updater's built-in
+  // Authenticode verification, which checks the downloaded installer against
+  // the SignPath Foundation publisherName that electron-builder embeds in
+  // app-update.yml. A no-op verifyUpdateCodeSignature override would silently
+  // accept every installer, so setup must NOT install one. (The issue #631
+  // stale-publisherName problem that once justified an override is resolved now
+  // that SignPath builds embed the correct publisherName.)
+  it('does not disable Windows Authenticode verification on win32', async () => {
     vi.stubGlobal('process', { ...process, platform: 'win32' })
 
     const { setupAutoUpdater } = await import('./updater')
@@ -1780,11 +1783,7 @@ describe('updater', () => {
 
     setupAutoUpdater(mainWindow as never)
 
-    // The override should be set on the autoUpdater mock
-    const override = (autoUpdaterMock as Record<string, unknown>).verifyUpdateCodeSignature
-    expect(override).toBeTypeOf('function')
-    // Calling it should resolve to null (meaning "signature valid, skip check")
-    await expect((override as () => Promise<string | null>)()).resolves.toBeNull()
+    expect((autoUpdaterMock as Record<string, unknown>).verifyUpdateCodeSignature).toBeUndefined()
   })
 
   it('does not override verifyUpdateCodeSignature on non-Windows platforms', async () => {
diff --git a/src/main/updater.ts b/src/main/updater.ts
index bc9c9d9b6..42924bdf0 100644
--- a/src/main/updater.ts
+++ b/src/main/updater.ts
@@ -1,6 +1,5 @@
 /* eslint-disable max-lines */
 import { app, BrowserWindow, powerMonitor } from 'electron'
-import type { NsisUpdater } from 'electron-updater'
 import { is } from '@electron-toolkit/utils'
 import type { UpdateCheckOptions, UpdateStatus } from '../shared/types'
 import { killAllPty } from './ipc/pty'
@@ -1269,15 +1268,11 @@ export function setupAutoUpdater(
     debug: (m: unknown) => console.debug('[autoUpdater]', m)
   } as never
 
-  // Why: older Windows installs either have no publisherName or have the
-  // stale macOS Apple Developer ID publisherName from issue #631. Keep the
-  // migration path open while SignPath-signed builds roll out.
-  //
-  // TODO: re-enable after SignPath-signed builds with the explicit Windows
-  // publisherName have been the minimum supported updater source for a while.
-  if (process.platform === 'win32') {
-    ;(autoUpdater as NsisUpdater).verifyUpdateCodeSignature = () => Promise.resolve(null)
-  }
+  // Why: Windows update integrity is enforced by electron-updater's built-in
+  // Authenticode check against the `publisherName` (SignPath Foundation) that
+  // electron-builder embeds in app-update.yml. Do NOT re-add a
+  // `verifyUpdateCodeSignature` override — a no-op override silently accepts
+  // every downloaded installer, disabling signature verification entirely.
 
   // Use the generic provider with GitHub's /releases/latest/download/ URL as
   // the startup fallback so electron-updater can fetch the manifest