diff --git a/.github/actions/setup-mux/action.yml b/.github/actions/setup-mux/action.yml
index 2764a8f58f..b999afb231 100644
--- a/.github/actions/setup-mux/action.yml
+++ b/.github/actions/setup-mux/action.yml
@@ -23,6 +23,7 @@ runs:
           ${{ runner.os }}-${{ runner.arch }}-bun-${{ steps.bun-version.outputs.version }}-node-modules-
 
     - name: Cache bun install cache
+      if: steps.cache-node-modules.outputs.cache-hit != 'true'
       id: cache-bun-install
       uses: actions/cache@v4
       with:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3c0dff6836..e07f45d1ab 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -18,7 +18,11 @@ jobs:
 
       - uses: ./.github/actions/setup-mux
 
+      # Skip signing setup for PRs - electron-builder skips signing anyway,
+      # but setting CSC_LINK forces our Makefile to build sequentially.
+      # Without CSC_LINK, x64 and arm64 build in parallel (~90s savings).
       - name: Setup code signing
+        if: github.event_name != 'pull_request'
         run: ./scripts/setup-macos-signing.sh
         env:
           MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
@@ -28,6 +32,7 @@ jobs:
           AC_APIKEY_ISSUER_ID: ${{ secrets.AC_APIKEY_ISSUER_ID }}
 
       - name: Verify signing setup
+        if: github.event_name != 'pull_request'
         run: |
           if [ -n "${CSC_LINK:-}" ]; then
             echo "✅ Code signing enabled"
@@ -39,8 +44,6 @@ jobs:
 
       - name: Package for macOS
         run: make dist-mac
-        env:
-          CSC_FOR_PULL_REQUEST: ${{ github.event.pull_request.number == 234 }}
 
       - name: Upload macOS DMG (x64)
         uses: actions/upload-artifact@v4