diff --git a/scripts/publish-update.sh b/scripts/publish-update.sh
index 4849151..0a1f266 100755
--- a/scripts/publish-update.sh
+++ b/scripts/publish-update.sh
@@ -214,7 +214,7 @@ fi
 # above, which is what ships. A no-op when the two happen to be the same.
 echo "==> Signing ${APP_BUNDLE} with resolved identity"
 run_signed codesign --force --options runtime --timestamp \
-    "${CODESIGN_KEYCHAIN_ARGS[@]}" \
+    ${CODESIGN_KEYCHAIN_ARGS[@]+"${CODESIGN_KEYCHAIN_ARGS[@]}"} \
     --sign "${SIGN_IDENTITY}" \
     --identifier "${BUNDLE_ID}" \
     "${APP_BUNDLE}"