diff --git a/.signpath/artifact-configuration.xml b/.signpath/artifact-configuration.xml
deleted file mode 100644
index a564642a2e..0000000000
--- a/.signpath/artifact-configuration.xml
+++ /dev/null
@@ -1,21 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
-  SignPath artifact configuration for tracedecay.
-
-  The release workflow uploads `tracedecay.exe` via actions/upload-artifact, which
-  wraps the single file in a ZIP. SignPath therefore receives a zip-file whose
-  root contains tracedecay.exe, which is Authenticode-signed and returned.
-
-  Paste the contents of this file into the SignPath portal:
-    Project "tracedecay" -> Artifact Configurations -> (default) -> Edit.
-  Keep this file in sync with the portal so the signed structure is reviewable in git.
-
-  Docs: https://docs.signpath.io/artifact-configuration/
--->
-<artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
-  <zip-file>
-    <pe-file path="tracedecay.exe">
-      <authenticode-sign/>
-    </pe-file>
-  </zip-file>
-</artifact-configuration>
diff --git a/SECURITY.md b/SECURITY.md
index 111fa91e8e..cec5d275af 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -151,13 +151,7 @@ cover the downloaded inventory asset itself. `NOASSERTION` licenses or unknown
 sources are explicitly annotated for review. The inventory is a traceability report,
 not a license scan or a claim that all components have been legally reviewed.
 
-**Windows:** Windows release binaries are currently unsigned. The repository contains a
-SignPath artifact-configuration example, but no release-workflow signing integration or
-verified SignPath project/certificate provisioning. Signing is not enforced by the release
-workflow; consumers must not assume an Authenticode signature or Smart App Control
-acceptance. Enabling signing remains blocked on external signing-service and certificate
-provisioning, followed by workflow and published-artifact verification. The previously cited
-PR #79 was unrelated and does not provide evidence for a Smart App Control report.
+**Windows:** Release executables are unsigned. Archive checksums and build-provenance attestations do not provide an executable code signature.
 
 ### Required daemon authority; optional service installation
 
diff --git a/docs/USER-GUIDE.md b/docs/USER-GUIDE.md
index 64dc8bf90c..eba12a1652 100644
--- a/docs/USER-GUIDE.md
+++ b/docs/USER-GUIDE.md
@@ -61,14 +61,16 @@ gh attestation verify tracedecay-beta-<tag>-<platform>.tar.gz --repo ScriptedAlc
   --signer-workflow ScriptedAlchemy/tracedecay/.github/workflows/release-beta.yml
 ```
 
-Stable archives (`tracedecay-<tag>-<platform>`) are signed by
-`.github/workflows/release.yml`.
+Stable archives (`tracedecay-<tag>-<platform>`) have build-provenance
+attestations from `.github/workflows/release.yml`.
 
 **Windows:**
 
 Download the x86_64 Windows archive from the
 [latest release](https://github.com/ScriptedAlchemy/tracedecay/releases/latest),
 extract `tracedecay.exe`, and place it on `PATH`.
+The Windows executable is unsigned; archive checksums and build-provenance
+attestations do not provide an executable code signature.
 
 **Prebuilt binaries:**