diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 66f9771b01b7..5bca097ee427 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -423,7 +423,7 @@ jobs:
                   if file "$f" | grep -qE 'Mach-O'; then
                     /usr/bin/codesign --force --options runtime --timestamp --sign "$APPLE_SIGNING_IDENTITY" --entitlements "$EMBEDDED_ENTITLEMENTS" "$f"
                   fi
-                done < <(find "$DIR" -type f -not -path '*.app/*' -print0)
+                done < <(find "$DIR" \( -type d -name '*.app' -prune \) -o \( -type f -print0 \))
 
                 # Pass 3: .framework, .plugin, .appex bundles (deepest-first)
                 while IFS= read -r -d '' bundle; do
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ee610a46d46a..53987af51d2b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -284,7 +284,7 @@ jobs:
                 if file "$f" | grep -qE 'Mach-O'; then
                   /usr/bin/codesign --force --options runtime --timestamp --sign "$APPLE_SIGNING_IDENTITY" --entitlements "$EMBEDDED_ENTITLEMENTS" "$f"
                 fi
-              done < <(find "$DIR" -type f -not -path '*.app/*' -print0)
+              done < <(find "$DIR" \( -type d -name '*.app' -prune \) -o \( -type f -print0 \))
 
               # Pass 3: .framework, .plugin, .appex bundles (deepest-first)
               while IFS= read -r -d '' bundle; do