diff --git a/windows/NTMakefile.w32 b/windows/NTMakefile.w32
index 8be267979..1847a805f 100644
--- a/windows/NTMakefile.w32
+++ b/windows/NTMakefile.w32
@@ -517,7 +517,7 @@ SIGNTOOL_T_SHA256=http://timestamp.digicert.com
 !endif
 
 _CODESIGN=( $(SIGNTOOL) sign /fd sha1 $(SIGNTOOL_O) /t $(SIGNTOOL_T) $(SIGNTOOL_C) /v $@ )
-_CODESIGN_SHA256=( $(SIGNTOOL) sign /as /fd sha256 $(SIGNTOOL_O) /tr $(SIGNTOOL_T_SHA256) $(SIGNTOOL_C) /v $@ )
+_CODESIGN_SHA256=( $(SIGNTOOL) sign /as /fd sha256 /td sha256 $(SIGNTOOL_O) /tr $(SIGNTOOL_T_SHA256) $(SIGNTOOL_C) /v $@ )
 !else
 _CODESIGN=( echo Skipping code sign )
 _CODESIGN_SHA256=( echo Skipping sha256 code sign )