diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 020eb1c00..a5ac73ddf 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -543,6 +543,34 @@ jobs:
             *-*-macos*.*
             urls.txt
 
+  win-llvm-from-mac:
+    runs-on: mac-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 8
+      - name: 'build'
+        env:
+          CW_LLVM_MINGW_DL: '1'
+          CW_LLVM_MINGW_ONLY: '0'
+        run: |
+          export CW_CONFIG='${{ github.ref_name }}-win'
+          export CW_REVISION='${{ github.sha }}'
+          . ./_versions.sh
+          sh -c ./_ci-mac-homebrew.sh
+
+      - name: 'list dependencies'
+        run: cat urls.txt
+      # https://github.com/actions/upload-artifact
+      - uses: actions/upload-artifact@v4
+        with:
+          name: 'curl-windows-llvm-from-mac'
+          retention-days: 5
+          path: |
+            *-*-mingw*.*
+            urls.txt
+
   win-llvm:
     runs-on: ubuntu-latest
     timeout-minutes: 30
diff --git a/_build.sh b/_build.sh
index 57c6fc218..8d8d42f51 100755
--- a/_build.sh
+++ b/_build.sh
@@ -452,7 +452,11 @@ fi
 
 if [ "${_OS}" = 'win' ] && \
    [ -s "${SIGN_CODE_KEY}" ]; then
-  osslsigncode --version  # We need 2.2 or newer
+  if command -v osslsigncode >/dev/null 2>&1; then
+    osslsigncode --version  # We need 2.2 or newer
+  else
+    unset SIGN_CODE_KEY_PASS
+  fi
 fi
 
 _ori_path="${PATH}"
diff --git a/_ci-linux-debian.sh b/_ci-linux-debian.sh
index 3a81a960d..f87de270f 100755
--- a/_ci-linux-debian.sh
+++ b/_ci-linux-debian.sh
@@ -21,7 +21,8 @@ fi
 [[ "${CW_CONFIG:-}" = *'boringssl'* ]] && extra+=' golang'
 
 if [[ "${CW_CONFIG:-}" = *'win'* ]]; then
-  extra+=' mingw-w64 osslsigncode wine64'
+  extra+=' mingw-w64 wine64'
+# extra+=' osslsigncode'
   if [[ "${CW_CONFIG:-}" = *'boringssl'* ]]; then
     extra+=' nasm'
   fi