diff --git a/.signpath/artifact-configurations/openadapt-desktop-installers.xml b/.signpath/artifact-configurations/openadapt-desktop-installers.xml
index 9975ac5a9..144ec3ab5 100644
--- a/.signpath/artifact-configurations/openadapt-desktop-installers.xml
+++ b/.signpath/artifact-configurations/openadapt-desktop-installers.xml
@@ -12,13 +12,18 @@
     the openadapt-engine sidecar) and then the MSI itself;
   * the NSIS setup executable is signed. SignPath cannot open an NSIS archive,
     so the program files it installs and its uninstaller stay unsigned.
+
+  Inside the MSI the program files sit under its install directory
+  (PFiles/OpenAdapt Desktop/), not at its root, and a bare "*" does not cross
+  a directory separator, so the includes use "**/". With "*.exe" the set
+  matched nothing and SignPath failed the request.
 -->
 <artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
   <zip-file>
     <msi-file path="*.msi">
       <pe-file-set>
-        <include path="*.exe" max-matches="unbounded" />
-        <include path="*.dll" min-matches="0" max-matches="unbounded" />
+        <include path="**/*.exe" max-matches="unbounded" />
+        <include path="**/*.dll" min-matches="0" max-matches="unbounded" />
         <for-each>
           <authenticode-sign />
         </for-each>
diff --git a/packages/desktop/tests/test_native_signing.py b/packages/desktop/tests/test_native_signing.py
index 489a0f95f..6875cbe18 100644
--- a/packages/desktop/tests/test_native_signing.py
+++ b/packages/desktop/tests/test_native_signing.py
@@ -239,6 +239,11 @@ def test_one_signpath_request_deep_signs_the_msi_and_signs_the_nsis_setup() -> N
     assert msi is not None and msi.get("path") == "*.msi"
     nested = msi.find("sp:pe-file-set/sp:for-each/sp:authenticode-sign", namespace)
     assert nested is not None, "the MSI's program files must be signed too"
+    # The program files sit under the MSI's install directory, and SignPath's
+    # "*" does not cross a directory separator: a root-only "*.exe" matches
+    # nothing and fails the signing request.
+    includes = msi.findall("sp:pe-file-set/sp:include", namespace)
+    assert includes and all(i.get("path", "").startswith("**/") for i in includes)
     assert msi.find("sp:authenticode-sign", namespace) is not None
     nsis = root.find("sp:zip-file/sp:pe-file", namespace)
     assert nsis is not None and nsis.get("path") == "*-setup.exe"