diff --git a/.ci/image/Dockerfile.msvc b/.ci/image/Dockerfile.msvc
index a9eab62..2f09e76 100644
--- a/.ci/image/Dockerfile.msvc
+++ b/.ci/image/Dockerfile.msvc
@@ -4,6 +4,7 @@ FROM dtmt-ci-base-linux
 ENV KEYRINGS /usr/local/share/keyrings
 ARG XWIN_VERSION=0.2.11
 ARG XWIN_PREFIX="xwin-$XWIN_VERSION-x86_64-unknown-linux-musl"
+ARG OSSLSIGNCODE_VERSION=2.7
 
 ADD https://apt.llvm.org/llvm-snapshot.gpg.key /root/llvm-snapshot.gpg.key
 ADD https://dl.winehq.org/wine-builds/winehq.key /root/winehq.key
@@ -20,13 +21,19 @@ RUN set -eux; \
     dpkg --add-architecture i386; \
     apt-get update; \
     apt-get install --no-install-recommends -y \
-        libclang-13-dev \
-        gcc-mingw-w64-x86-64 \
-        clang-13 \
-        llvm-13 \
-        lld-13 \
-        winehq-staging \
-        tar; \
+    cmake \
+    libssl-dev \
+    libcurl4-openssl-dev \
+    zlib1g-dev \
+    python3 \
+    libclang-13-dev \
+    gcc-mingw-w64-x86-64 \
+    clang-13 \
+    llvm-13 \
+    lld-13 \
+    winehq-staging \
+    tar \
+    ; \
     # ensure that clang/clang++ are callable directly
     ln -s clang-13 /usr/bin/clang && ln -s clang /usr/bin/clang++ && ln -s lld-13 /usr/bin/ld.lld; \
     # We also need to setup symlinks ourselves for the MSVC shims because they aren't in the debian packages
@@ -51,11 +58,24 @@ RUN set -eux; \
     # Remove unneeded files to reduce image size
     apt-get remove -y --auto-remove; \
     rm -rf \
-        .xwin-cache \
-        /usr/local/cargo/bin/xwin \
-        /root/$XWIN_PREFIX.tar.gz \
-        /var/lib/apt/lists/* \
-        /root/*.key;
+    .xwin-cache \
+    /usr/local/cargo/bin/xwin \
+    /root/$XWIN_PREFIX.tar.gz \
+    /var/lib/apt/lists/* \
+    /root/*.key;
+
+ADD https://github.com/mtrojnar/osslsigncode/archive/refs/tags/${OSSLSIGNCODE_VERSION}.tar.gz /root/osslsigncode.tar.gz
+
+RUN set -ex; \
+    tar -xzv -f /root/osslsigncode.tar.gz;\
+    cd osslsigncode-${OSSLSIGNCODE_VERSION}; \
+    cmake -B build -S . -DCMAKE_BUILD_TYPE=Release; \
+    cmake --build build; \
+    cmake --install build; \
+    cd ../; \
+    rm -rf \
+    /root/osslsigncode.tar.gz \
+    osslsigncode-${OSSLSIGNCODE_VERSION};
 
 # Note that we're using the full target triple for each variable instead of the
 # simple CC/CXX/AR shorthands to avoid issues when compiling any C/C++ code for
diff --git a/.gitignore b/.gitignore
index 7f254dd..e405f86 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,6 @@
 *.dll
 *.lib
 dictionary.csv
+
+signing/*
+!signing/.gitkeep
diff --git a/signing/.gitkeep b/signing/.gitkeep
new file mode 100644
index 0000000..e69de29