diff --git a/tools/desktop-release.ts b/tools/desktop-release.ts
index 974fb6c..fb60ab3 100644
--- a/tools/desktop-release.ts
+++ b/tools/desktop-release.ts
@@ -222,7 +222,7 @@ function signFile(file: string): string {
   rmSync(`${file}.sig`, { force: true });
   // the key goes by path only: a TAURI_SIGNING_PRIVATE_KEY left in the env (a bundle step, the shell) made the signer
   // refuse "--private-key-path cannot be used with --private-key" (0.8.59)
-  const env = { ...process.env, TAURI_SIGNING_PRIVATE_KEY_PASSWORD: '' };
+  const env: Record<string, string | undefined> = { ...process.env, TAURI_SIGNING_PRIVATE_KEY_PASSWORD: '' };
   delete env.TAURI_SIGNING_PRIVATE_KEY; delete env.TAURI_SIGNING_PRIVATE_KEY_PATH;
   run(['bunx', 'tauri', 'signer', 'sign', '-f', key, '-p', '', file], { cwd: APP_DIR, env });
   const sig = readFileSync(`${file}.sig`, 'utf8').trim();