diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index fd5adf85..2b7bbba6 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -14,7 +14,7 @@ jobs:
         - /opt/keys:/opt/keys
         - /opt/deps:/opt/deps
     steps:
-      - run: apt update && apt install -y doxygen git graphviz mingw-w64 libgpgme11 gcc-aarch64-linux-gnu zip unzip build-essential docker.io curl clang file
+      - run: apt update && apt install -y doxygen git graphviz mingw-w64 libgpgme11 gcc-aarch64-linux-gnu zip unzip build-essential docker.io curl clang file cmake
       - name: check out code
         uses: actions/checkout@v4
         with:
diff --git a/.gitmodules b/.gitmodules
index d96f52a1..79ec17a3 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -29,3 +29,6 @@
 [submodule "docs"]
 	path = docs
 	url = https://dev.tildefriends.net/cory/tildefriends.wiki.git
+[submodule "deps/zsign"]
+	path = deps/zsign
+	url = https://github.com/zhlynn/zsign.git
diff --git "a/0\016\001\f\a׀\a" "b/0\016\001\f\a׀\a"
deleted file mode 100644
index e69de29b..00000000
diff --git a/GNUmakefile b/GNUmakefile
index 3c346d43..64eaddf3 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -1101,12 +1101,17 @@ out/data.zip: $(RAW_FILES)
 	@echo [zip] $@
 	@zip -u $@ -q -9 $(RAW_FILES)
 
-out/tildefriends-%.app/tildefriends: out/%/tildefriends out/tildefriends-%.app/Info.plist out/tildefriends-%.app/tildefriends.png out/data.zip
+out/zsign_build/zsign: $(wildcard deps/zsign/*.cpp deps/zsign/*.h deps/zsign/*.txt deps/zsign/common/*)
+	@echo [cmake] $@
+	@cmake -B out/zsign_build deps/zsign
+	@cmake --build out/zsign_build
+
+out/tildefriends-%.app/tildefriends: out/%/tildefriends out/tildefriends-%.app/Info.plist out/tildefriends-%.app/tildefriends.png out/data.zip out/zsign_build/zsign
 	@mkdir -p $(dir $@)
-	@cp -v $< $@
+	@cp -v $(filter-out out/zsign%,$<) $@
 	@cp -v out/data.zip $(@D)/
 ifeq ($(HAVE_LINUX_IOS),1)
-	@zsign -q -k .keys/apple.p12 -f -m src/ios/embedded.mobileprovision $(realpath $(dir $@))
+	@out/zsign_build/zsign -q -k .keys/apple.p12 -f -m src/ios/embedded.mobileprovision $(realpath $(dir $@))
 endif
 .SECONDARY:
 out/tildefriends-%.ipa: out/tildefriends-ios%.app/tildefriends
diff --git a/deps/zsign b/deps/zsign
new file mode 160000
index 00000000..d995d539
--- /dev/null
+++ b/deps/zsign
@@ -0,0 +1 @@
+Subproject commit d995d539ff16f28d985f5b2a1c62dd4eb9f029ea