diff --git a/tools/release.ts b/tools/release.ts
index f32af01..c96807a 100644
--- a/tools/release.ts
+++ b/tools/release.ts
@@ -247,6 +247,16 @@ async function main(): Promise<void> {
   const out = join(RELEASES, 'desktop', version);
   const logDir = join(RELEASES, 'logs', version);
   const host = publishHost();
+  // one release at a time on this Mac: two runs once built into the same target folder and the signing failed
+  if (yes) {
+    const lock = join(RELEASES, 'release.lock');
+    const held = existsSync(lock) ? Number(readFileSync(lock, 'utf8').trim()) : 0;
+    const alive = held > 0 && (() => { try { process.kill(held, 0); return true; } catch { return false; } })();
+    if (alive && held !== process.pid) fail(`another release runs (pid ${held}, ${lock.replace(HOME, '~')}): wait for it, or end it first`);
+    mkdirSync(RELEASES, { recursive: true });
+    writeFileSync(lock, `${process.pid}\n`);
+    process.on('exit', () => { try { if (readFileSync(lock, 'utf8').trim() === String(process.pid)) rmSync(lock, { force: true }); } catch { /* gone */ } });
+  }
 
   // ---------------------------------------------------------------- 1. preflight
   const remote = remoteSessionReason(process.env, sh(['launchctl', 'managername'], { allowFail: true }).trim());