diff --git a/F4SDM42WebApi/M42SandboxedExtension.targets b/F4SDM42WebApi/M42SandboxedExtension.targets
index 7bae26a..1c52b73 100644
--- a/F4SDM42WebApi/M42SandboxedExtension.targets
+++ b/F4SDM42WebApi/M42SandboxedExtension.targets
@@ -8,12 +8,15 @@
     <M42PackageTemplateDir Condition="'$(M42PackageTemplateDir)' == ''">$(MSBuildProjectDirectory)\..\PackageTemplate</M42PackageTemplateDir>
     <M42PackageOutputRoot Condition="'$(M42PackageOutputRoot)' == ''">$(MSBuildProjectDirectory)\..\artifacts</M42PackageOutputRoot>
     <M42PackageBuildScript Condition="'$(M42PackageBuildScript)' == ''">$(MSBuildProjectDirectory)\BuildM42Package.ps1</M42PackageBuildScript>
-    <M42SignAssemblies Condition="'$(M42SignAssemblies)' == '' AND $([System.String]::Copy('$(Configuration)').StartsWith('Release'))">true</M42SignAssemblies>
     <M42SignAssemblies Condition="'$(M42SignAssemblies)' == ''">false</M42SignAssemblies>
     <M42SignTool Condition="'$(M42SignTool)' == ''">$(MSBuildProjectDirectory)\..\..\..\Common Code\Tools\signtool.exe</M42SignTool>
     <M42SignTimestampUrl Condition="'$(M42SignTimestampUrl)' == ''">http://rfc3161timestamp.globalsign.com/advanced</M42SignTimestampUrl>
     <M42SignDescription Condition="'$(M42SignDescription)' == ''">C4IT - F4SD - WebApi for M42</M42SignDescription>
     <M42SignOptions Condition="'$(M42SignOptions)' == ''">/a</M42SignOptions>
+    <_M42SignCertificateArgs Condition="'$(M42SignCertificateFile)' != '' AND '$(M42SignCertificatePassword)' != ''">/f "$(M42SignCertificateFile)" /p "$(M42SignCertificatePassword)"</_M42SignCertificateArgs>
+    <_M42SignCertificateArgs Condition="'$(M42SignCertificateFile)' != '' AND '$(M42SignCertificatePassword)' == ''">/f "$(M42SignCertificateFile)"</_M42SignCertificateArgs>
+    <_M42SignCertificateArgs Condition="'$(_M42SignCertificateArgs)' == '' AND '$(M42SignCertificateThumbprint)' != ''">/sha1 "$(M42SignCertificateThumbprint)"</_M42SignCertificateArgs>
+    <_M42SignCertificateArgs Condition="'$(_M42SignCertificateArgs)' == ''">$(M42SignOptions)</_M42SignCertificateArgs>
   </PropertyGroup>
 
   <Target Name="M42_BuildAllRids"
@@ -95,7 +98,7 @@
              Text="Signing Matrix42 package assemblies with $(M42SignTool)." />
 
     <Exec Condition="'@(_M42AssembliesToSign)' != ''"
-          Command="&quot;$(M42SignTool)&quot; sign $(M42SignOptions) /tr &quot;$(M42SignTimestampUrl)&quot; /td SHA256 /fd SHA256 /d &quot;$(M42SignDescription)&quot; &quot;%(_M42AssembliesToSign.FullPath)&quot;" />
+          Command="&quot;$(M42SignTool)&quot; sign $(_M42SignCertificateArgs) /tr &quot;$(M42SignTimestampUrl)&quot; /td SHA256 /fd SHA256 /d &quot;$(M42SignDescription)&quot; &quot;%(_M42AssembliesToSign.FullPath)&quot;" />
   </Target>
 
   <Target Name="M42_BuildPackage"
diff --git a/F4SDM42WebApi/SignSourceFiles.cmd b/F4SDM42WebApi/SignSourceFiles.cmd
index 0668ee7..09a49b1 100644
--- a/F4SDM42WebApi/SignSourceFiles.cmd
+++ b/F4SDM42WebApi/SignSourceFiles.cmd
@@ -2,7 +2,7 @@
 setlocal
 
 pushd "%~dp0.."
-dotnet build "F4SDM42WebApi\F4SD - M42WebApi.csproj" -c Release %*
+dotnet build "F4SDM42WebApi\F4SD - M42WebApi.csproj" -c Release /p:M42SignAssemblies=true %*
 set EXITCODE=%ERRORLEVEL%
 popd
 
diff --git a/docs/matrix42-26-1-extension-migration.md b/docs/matrix42-26-1-extension-migration.md
index c4795e8..529314c 100644
--- a/docs/matrix42-26-1-extension-migration.md
+++ b/docs/matrix42-26-1-extension-migration.md
@@ -38,13 +38,16 @@ artifacts/<PackageName> v<Version>/
 artifacts/<PackageName> v<Version>.zip
 ```
 
-Release-Builds signieren die DLLs im Package automatisch per Authenticode, bevor das Package gebaut wird. Debug-Builds bleiben unsigniert.
+Builds signieren die DLLs nicht automatisch. Signieren ist optional und muss explizit aktiviert werden. Wenn `M42SignAssemblies=true` gesetzt ist, werden die DLLs im Package vor dem Package-Build per Authenticode signiert.
 
 Konfigurierbare MSBuild-Properties:
 
 ```powershell
-/p:M42SignAssemblies=false
+/p:M42SignAssemblies=true
 /p:M42SignTool="C:\Path\To\signtool.exe"
+/p:M42SignCertificateThumbprint="<thumbprint>"
+/p:M42SignCertificateFile="C:\Path\To\certificate.pfx"
+/p:M42SignCertificatePassword="<password>"
 /p:M42SignTimestampUrl="http://rfc3161timestamp.globalsign.com/advanced"
 /p:M42SignOptions="/a"
 ```
@@ -55,6 +58,12 @@ Build-Befehl:
 dotnet build "C:\Workspace\C4IT FASD\F4SD_M42WebApi\C4IT - F4SD - M42WebApi.sln" -c Release
 ```
 
+Signierter Release-Build:
+
+```powershell
+dotnet build "C:\Workspace\C4IT FASD\F4SD_M42WebApi\F4SDM42WebApi\F4SD - M42WebApi.csproj" -c Release /p:M42SignAssemblies=true
+```
+
 ## Host-Konfig
 
 Die Host-Konfig muss exakt zum Assembly-Namen passen: