diff --git a/.github/actions/macos-code-sign/action.yml b/.github/actions/macos-code-sign/action.yml
index 9c14931a02..a5b6c38450 100644
--- a/.github/actions/macos-code-sign/action.yml
+++ b/.github/actions/macos-code-sign/action.yml
@@ -44,6 +44,11 @@ runs:
           exit 1
         fi
 
+        if [[ "${APPLE_CERTIFICATE_PASSWORD+__codex_password_is_set__}" != "__codex_password_is_set__" ]]; then
+          echo "APPLE_CERTIFICATE_PASSWORD must be set for macOS signing"
+          exit 1
+        fi
+
         cert_path="${RUNNER_TEMP}/apple_signing_certificate.p12"
         echo "$APPLE_CERTIFICATE" | base64 -d > "$cert_path"