diff --git a/fastlane/Fastfile b/fastlane/Fastfile
index 7d6a873..bc5d738 100644
--- a/fastlane/Fastfile
+++ b/fastlane/Fastfile
@@ -37,7 +37,17 @@ end
 lane :beta do |options|
   desc "Build and upload to TestFlight"
 
-  get_provisioning_profile(api_key_path: "fastlane/apikey.json")
+  # force: true - without it, sigh just downloads whatever profile
+  # already exists on Apple's servers as-is. This CI keychain's
+  # distribution certificate is a different one than whatever the
+  # existing profile was last generated against, so a plain (non-forced)
+  # fetch produced a profile that doesn't include this machine's cert -
+  # "Provisioning profile ... doesn't include signing certificate
+  # 'iPhone Distribution: Loverde Company LTDA (K4E5BZMM4V)'" at archive
+  # time. Forcing a renewal makes sigh regenerate the profile against
+  # the team's currently valid certificates instead of reusing a stale
+  # one.
+  get_provisioning_profile(api_key_path: "fastlane/apikey.json", force: true)
 
   assemble
 
@@ -55,7 +65,17 @@ lane :release do |options|
 
   # if you have an apikey.json file (https://developer.apple.com/documentation/appstoreconnectapi/creating-api-keys-for-app-store-connect-api), fastlane can automatically fetch certificates and the ASC authentication information
   #get_certificates(api_key_path: "fastlane/apikey.json")
-  get_provisioning_profile(api_key_path: "fastlane/apikey.json")
+  # force: true - without it, sigh just downloads whatever profile
+  # already exists on Apple's servers as-is. This CI keychain's
+  # distribution certificate is a different one than whatever the
+  # existing profile was last generated against, so a plain (non-forced)
+  # fetch produced a profile that doesn't include this machine's cert -
+  # "Provisioning profile ... doesn't include signing certificate
+  # 'iPhone Distribution: Loverde Company LTDA (K4E5BZMM4V)'" at archive
+  # time. Forcing a renewal makes sigh regenerate the profile against
+  # the team's currently valid certificates instead of reusing a stale
+  # one.
+  get_provisioning_profile(api_key_path: "fastlane/apikey.json", force: true)
 
   assemble