diff --git a/eng/Signing.props b/eng/Signing.props
index 7537e82282fc..59a8aac0657b 100644
--- a/eng/Signing.props
+++ b/eng/Signing.props
@@ -28,6 +28,11 @@
     <RedistNetCorePath>$(BaseRedistNetCorePath)$(TargetRuntimeIdentifier)\</RedistNetCorePath>
   </PropertyGroup>
 
+  <ItemGroup Label="Catalog signing">
+    <!-- Sign catalog files that cover customer-modifiable template content -->
+    <FileExtensionSignInfo Include=".cat" CertificateName="Microsoft400" />
+  </ItemGroup>
+
   <ItemGroup Label="Code sign exclusions">
     <!-- We don't produce font files. We rebundle some for using the web browser, so they do not need to be signed. -->
     <FileExtensionSignInfo Update=".otf" CertificateName="None" />
@@ -36,7 +41,8 @@
     <FileSignInfo Include="ancm.mof" CertificateName="None" />
     <!-- Exclude the apphost because this is expected to be code-signed by customers after the SDK modifies it. -->
     <FileSignInfo Include="apphost.exe" CertificateName="None" />
-    <!-- We don't need to code sign .js files because they are not used in Windows Script Host. -->
+    <!-- Customer-modifiable template files: skip Authenticode because users edit these after
+         project creation. Covered by catalog signing instead (see .cat entry above). -->
     <FileExtensionSignInfo Update=".js" CertificateName="None" />
 
     <!--