diff --git a/.github/workflows/testflight.yml b/.github/workflows/testflight.yml
index ab982b6..42df7e2 100644
--- a/.github/workflows/testflight.yml
+++ b/.github/workflows/testflight.yml
@@ -10,10 +10,12 @@
 #                                                           "App Manager" role)
 #   base64 encode:  base64 -i AuthKey_XXXXXXXXXX.p8 | pbcopy
 #
-# Archive uses Apple Distribution (not Apple Development). Ephemeral GitHub runners have an
-# empty keychain, so Automatic+Development minted a new development cert every run until
-# the account hit Apple's cap and every archive died with "Choose a certificate to revoke"
-# plus "No profiles for com.sanylax.continuity" (development profiles).
+# Archive signing is per-target (Continuity + ContinuityShare: Manual + Apple Distribution
+# in project.yml Release). Do NOT pass CODE_SIGN_IDENTITY / CODE_SIGN_STYLE as xcodebuild
+# xcargs — Xcode applies those to every target, including YouTubeKit's resource bundle,
+# and Xcode 26 treats Automatic + a forced Distribution identity as a hard error
+# ("conflicting provisioning settings"). Cloud signing (-allowProvisioningUpdates +
+# the ASC API key) mints the App Store profiles. The export step re-signs the IPA.
 #
 # CFBundleVersion is 1000 + github.run_number. TestFlight already has build 130 (Xcode Cloud,
 # Jul 18) while run_number is still in the 30s — a raw run_number would be rejected as older.
@@ -79,8 +81,6 @@ jobs:
             -archivePath build/Continuity.xcarchive \
             CURRENT_PROJECT_VERSION="$BUILD_NUMBER" \
             DEVELOPMENT_TEAM=KP832RV67A \
-            CODE_SIGN_STYLE=Automatic \
-            CODE_SIGN_IDENTITY="Apple Distribution" \
             -allowProvisioningUpdates \
             -authenticationKeyPath "$HOME/private_keys/AuthKey_${ASC_KEY_ID}.p8" \
             -authenticationKeyID "$ASC_KEY_ID" \
diff --git a/project.yml b/project.yml
index c18cb07..5e70c24 100644
--- a/project.yml
+++ b/project.yml
@@ -19,12 +19,6 @@ settings:
     CURRENT_PROJECT_VERSION: "2"
     DEVELOPMENT_TEAM: "KP832RV67A"
     CODE_SIGN_STYLE: Automatic
-  configs:
-    # Release archives must use Distribution. Automatic + Development on ephemeral
-    # CI runners minted a new Apple Development cert every TestFlight run until the
-    # account hit the cap ("Choose a certificate to revoke").
-    Release:
-      CODE_SIGN_IDENTITY: Apple Distribution
 
 targets:
   Continuity:
@@ -87,6 +81,13 @@ targets:
         ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME: AccentColor
         ENABLE_PREVIEWS: YES
         SWIFT_EMIT_LOC_STRINGS: YES
+      configs:
+        # Per-target so Distribution does not leak onto YouTubeKit's resource bundle.
+        # Automatic + "Apple Distribution" is a hard error in Xcode 26
+        # ("conflicting provisioning settings").
+        Release:
+          CODE_SIGN_STYLE: Manual
+          CODE_SIGN_IDENTITY: Apple Distribution
     # onnxruntime SPM ships a *static* .framework (Mach-O archive, not a dylib). Xcode still
     # copies a broken ~50 KB stub into Continuity.app/Frameworks. That stub:
     #   - fails code-sign / ITMS MinimumOSVersion checks (microsoft/onnxruntime#27396)
@@ -150,3 +151,7 @@ targets:
         GENERATE_INFOPLIST_FILE: NO
         TARGETED_DEVICE_FAMILY: "1"
         SWIFT_EMIT_LOC_STRINGS: YES
+      configs:
+        Release:
+          CODE_SIGN_STYLE: Manual
+          CODE_SIGN_IDENTITY: Apple Distribution