diff --git a/README.md b/README.md
index 25cb11b..7da12fa 100644
--- a/README.md
+++ b/README.md
@@ -142,8 +142,8 @@ directory on the user PATH, producing exactly the layout `rb setup`
 creates, and removes both again on uninstall. rbmanager is a single MSI
 product line; see [docs/upgrade-code.md](docs/upgrade-code.md). WiX
 5.0.2 comes in through the `WixToolset.Sdk` NuGet package, and ICE
-validation runs as part of the build. The MSI is currently unsigned;
-only the release rb.exe is signed (see below).
+validation runs as part of the build. The MSI is unsigned, and so is
+the release rb.exe for now (see below).
 
 An earlier iteration packaged each Ruby version as its own MSI. That
 direction was dropped in favor of rbmanager; see the git history for
@@ -152,17 +152,16 @@ the sources and the verification record.
 ## Releases and code signing
 
 Pushing a `v*` tag runs `.github/workflows/release.yml`, which builds
-NativeAOT rb.exe for win-x64 and win-arm64, signs both, and attaches
-them with `.sha256` checksums to a GitHub release. rb.exe is the one
-binary users download directly with a browser, so it faces SmartScreen
-with the Mark of the Web attached; it is the first signing target,
-ahead of the MSI and winget channels. CI builds stay unsigned.
-
-Free code signing provided by [SignPath.io](https://signpath.io),
-certificate by [SignPath Foundation](https://signpath.org). The
-signing step is isolated in `.github/actions/sign` so the provider can
-be replaced later; the signing policy, the repository configuration,
-and the SignPath application checklist are in
+NativeAOT rb.exe for win-x64 and win-arm64 and attaches them with
+`.sha256` checksums to a GitHub release. rb.exe is the one binary
+users download directly with a browser, so it faces SmartScreen with
+the Mark of the Web attached; it is the first signing target, ahead of
+the MSI and winget channels. CI builds stay unsigned.
+
+Code signing is on hold, so the release binaries are unsigned for now.
+The signing step stays in place, isolated in `.github/actions/sign` so
+the provider can be replaced later. The signing policy, the repository
+configuration, and the SignPath application checklist are in
 [docs/code-signing.md](docs/code-signing.md).
 
 ## CA trust bootstrap
diff --git a/docs/code-signing.md b/docs/code-signing.md
index c5f0eb6..821fc87 100644
--- a/docs/code-signing.md
+++ b/docs/code-signing.md
@@ -3,6 +3,9 @@
 This document is the code signing policy for rbmanager and the
 operating manual for the release signing pipeline.
 
+Signing is on hold for now, so releases ship unsigned through the
+draft path described below.
+
 ## What is signed, and why rb.exe first
 
 The only signed artifacts are the release builds of `rb.exe`