diff --git a/.github/workflows/migrate-release-secrets.yml b/.github/workflows/migrate-release-secrets.yml
index 37ed836..4305d6c 100644
--- a/.github/workflows/migrate-release-secrets.yml
+++ b/.github/workflows/migrate-release-secrets.yml
@@ -77,8 +77,11 @@ jobs:
             exit 1
           }
           export CERT_PASSWORD
+          # The existing Apple Developer ID certificate is a legacy PKCS#12
+          # bundle. OpenSSL 3 requires its legacy provider to read RC2-40-CBC.
           printf '%s' "$CERT_BASE64" | base64 --decode |
-            openssl pkcs12 -in /dev/stdin -passin env:CERT_PASSWORD -noout
+            openssl pkcs12 -legacy -in /dev/stdin \
+              -passin env:CERT_PASSWORD -noout
 
           copy_secret() {
             local name="$1"