diff --git a/ios/fastlane/Fastfile b/ios/fastlane/Fastfile
index d517dec..1e8b481 100644
--- a/ios/fastlane/Fastfile
+++ b/ios/fastlane/Fastfile
@@ -8,8 +8,7 @@ TEAM_ID = "DQQH5H6GBD"
 PROFILE_NAME = "Sybil AppStore CI"
 CI_KEYCHAIN_NAME = "sybil_ci_keychain"
 CI_KEYCHAIN_PASSWORD = "sybil-ci-keychain-password"
-CI_KEYCHAIN_PATH = File.expand_path("~/Library/Keychains/#{CI_KEYCHAIN_NAME}")
-CI_KEYCHAIN_DB_PATH = "#{CI_KEYCHAIN_PATH}-db"
+CI_KEYCHAIN_DB_PATH = File.expand_path("~/Library/Keychains/#{CI_KEYCHAIN_NAME}-db")
 IOS_ROOT = File.expand_path("..", __dir__)
 PROJECT_FILE = File.join(IOS_ROOT, "Sybil.xcodeproj")
 PROJECT_SPEC = File.join(IOS_ROOT, "project.yml")
@@ -62,26 +61,6 @@ def stamp_marketing_version(version)
   File.write(APP_PROJECT_SPEC, updated)
 end
 
-def ci_keychain_path
-  File.file?(CI_KEYCHAIN_DB_PATH) ? CI_KEYCHAIN_DB_PATH : CI_KEYCHAIN_PATH
-end
-
-def signing_xcargs
-  args = [
-    "DEVELOPMENT_TEAM=#{TEAM_ID.shellescape}",
-    "CODE_SIGN_STYLE=Manual",
-    "CODE_SIGN_IDENTITY=Apple\\ Distribution",
-    "PROVISIONING_PROFILE_SPECIFIER=#{PROFILE_NAME.shellescape}"
-  ]
-
-  if ci?
-    args << "CODE_SIGN_KEYCHAIN=#{ci_keychain_path.shellescape}"
-    args << "OTHER_CODE_SIGN_FLAGS=#{("--keychain #{ci_keychain_path}").shellescape}"
-  end
-
-  args.join(" ")
-end
-
 platform :ios do
   private_lane :app_store_api_key do
     app_store_connect_api_key(
@@ -92,13 +71,13 @@ platform :ios do
     )
   end
 
-  # CI uses a dedicated throwaway keychain for match. build_app passes this
-  # keychain explicitly so codesign does not depend on the runner's ambient
-  # login/default keychain state.
+  # CI has no login keychain, so create a dedicated throwaway one for match to
+  # import the distribution cert into. The runner's launchd job sets
+  # SessionCreate, so add_to_search_list actually makes it visible to xcodebuild.
   private_lane :prepare_ci_keychain do
     next unless ci?
 
-    delete_keychain(name: CI_KEYCHAIN_NAME) if File.file?(CI_KEYCHAIN_DB_PATH) || File.file?(CI_KEYCHAIN_PATH)
+    delete_keychain(name: CI_KEYCHAIN_NAME) if File.file?(CI_KEYCHAIN_DB_PATH)
     create_keychain(
       name: CI_KEYCHAIN_NAME,
       password: CI_KEYCHAIN_PASSWORD,
@@ -151,7 +130,12 @@ platform :ios do
       scheme: SCHEME,
       export_method: "app-store",
       codesigning_identity: "Apple Distribution",
-      xcargs: signing_xcargs,
+      xcargs: [
+        "DEVELOPMENT_TEAM=#{TEAM_ID.shellescape}",
+        "CODE_SIGN_STYLE=Manual",
+        "CODE_SIGN_IDENTITY=Apple\\ Distribution",
+        "PROVISIONING_PROFILE_SPECIFIER=#{PROFILE_NAME.shellescape}"
+      ].join(" "),
       export_options: {
         signingStyle: "manual",
         teamID: TEAM_ID,