diff --git a/ios/scripts/build-ipa.sh b/ios/scripts/build-ipa.sh
index f4bc4f6..2cc3f8a 100755
--- a/ios/scripts/build-ipa.sh
+++ b/ios/scripts/build-ipa.sh
@@ -1,5 +1,6 @@
 #!/bin/bash
-# Builds an unsigned build/stemify-<version>.ipa on a Mac, for re-signing with Sideloadly/AltStore.
+# Builds build/stemify-<version>.ipa on a Mac. Unsigned by default, for re-signing with Sideloadly/AltStore.
+# With prov/Stemify.mobileprovision, prov/key.p12 and P12_PASS set, it signs with them (keeps CarPlay/Siri).
 # Uses swiftc directly so it works even when xcodebuild/actool need -runFirstLaunch.
 set -euo pipefail
 cd "$(dirname "$0")/.."
@@ -34,5 +35,25 @@ SRC=Stemify/Resources/Assets.xcassets/AppIcon.appiconset/icon.png
 sips -z 120 120 $SRC --out $APP/AppIcon60x60@2x.png >/dev/null
 sips -z 180 180 $SRC --out $APP/AppIcon60x60@3x.png >/dev/null
 
+if [ -f prov/Stemify.mobileprovision ] && [ -f prov/key.p12 ] && [ -n "${P12_PASS:-}" ]; then
+  KC=$PWD/$OUT/sign.keychain-db; KP=$(uuidgen)
+  security create-keychain -p "$KP" $KC
+  security set-keychain-settings -lut 3600 $KC
+  security unlock-keychain -p "$KP" $KC
+  security import prov/key.p12 -P "$P12_PASS" -A -t agg -f pkcs12 -k $KC >/dev/null
+  # The dev cert chains to Apple's WWDR G3 intermediate, which a fresh keychain doesn't have.
+  [ -f prov/wwdr.cer ] || curl -fsSL -o prov/wwdr.cer https://www.apple.com/certificateauthority/AppleWWDRCAG3.cer
+  security import prov/wwdr.cer -A -k $KC >/dev/null 2>&1 || true
+  security set-key-partition-list -S apple-tool:,apple: -s -k "$KP" $KC >/dev/null
+  security list-keychains -d user -s $KC $(security list-keychains -d user | tr -d '"')
+  ID=$(security find-identity -v -p codesigning $KC | sed -nE 's/.*"(Apple Development:.*)"/\1/p' | head -1)
+  security cms -D -i prov/Stemify.mobileprovision > $OUT/prov.plist
+  /usr/libexec/PlistBuddy -x -c 'Print :Entitlements' $OUT/prov.plist > $OUT/ent.plist
+  cp prov/Stemify.mobileprovision $APP/embedded.mobileprovision
+  codesign -f -s "$ID" --entitlements $OUT/ent.plist --timestamp=none $APP
+  security delete-keychain $KC
+  echo "signed as $ID"
+fi
+
 (cd $OUT && zip -qry stemify-$VERSION.ipa Payload)
 echo "$OUT/stemify-$VERSION.ipa"