diff --git a/Dockerfile b/Dockerfile
index 97b4589..6c9c762 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -204,8 +204,8 @@ RUN curl --insecure --location --remote-name-all --remote-header-name \
  && tar xJf 7z$Z7_VERSION-src.tar.xz -C 7z
 
 FROM base AS dl-aas-sign
-ARG AAS_SIGN_VERSION=1.0.0 \
-    AAS_SIGN_SHA256=cd12b1de361bcd131cf2670e8316e87ec92f2219c32dbeffb01e27675f955c83
+ARG AAS_SIGN_VERSION=1.1.0 \
+    AAS_SIGN_SHA256=4ba127b0434f6e0f8af639e51a0c961e95b5adeb06391dd6ef02445e0b027c3f
 WORKDIR /dl
 RUN curl --insecure --location --remote-name-all --remote-header-name \
     https://github.com/skeeto/aas-sign/releases/download/v$AAS_SIGN_VERSION/aas-sign-$AAS_SIGN_VERSION.tar.gz \
diff --git a/src/sign-and-pack.sh b/src/sign-and-pack.sh
index 06d12a2..e7702e9 100755
--- a/src/sign-and-pack.sh
+++ b/src/sign-and-pack.sh
@@ -9,6 +9,9 @@
 # must be forwarded with `docker run -e`. The signing target (endpoint /
 # account / profile) is taken from environment variables below; they're
 # not secret but they're configuration the container shouldn't bake in.
+#
+# aas-sign 1.1.0+ retries transient TLS / network errors internally,
+# so this script just calls it once and trusts it.
 
 set -e
 : "${AAS_SIGN_ENDPOINT:?AAS_SIGN_ENDPOINT not set}"
@@ -19,38 +22,24 @@ set -e
 # that progress output doesn't corrupt the binary stream on stdout.
 exec 3>&1 1>&2
 
-# Wrap aas-sign in a small retry loop. Azure occasionally returns a
-# spurious TLS handshake error under concurrency (mbedTLS reports it as
-# "Generic error" or "This is a bug in the library"); retrying clears
-# it. aas-sign's inject_signature overwrites any existing signature, so
-# re-signing already-signed files is harmless, just slower.
-sign() {
-    attempt=1
-    until aas-sign sign --max-parallel 8 \
-                        --endpoint "$AAS_SIGN_ENDPOINT" \
-                        --account  "$AAS_SIGN_ACCOUNT" \
-                        --profile  "$AAS_SIGN_PROFILE" \
-                        "$@"; do
-        if [ $attempt -ge 3 ]; then
-            echo "aas-sign failed after $attempt attempts" >&2
-            return 1
-        fi
-        attempt=$((attempt + 1))
-        echo "aas-sign failed; retrying (attempt $attempt of 3)..." >&2
-        sleep $((attempt * 3))
-    done
-}
-
 # Sign every executable and DLL inside the toolchain. Toolchain paths
-# don't contain whitespace, so plain word splitting is fine here.
-sign $(find "$PREFIX" -type f \( -name '*.exe' -o -name '*.dll' \))
+# don't contain whitespace, so plain word splitting through xargs is
+# fine here.
+find "$PREFIX" -type f \( -name '*.exe' -o -name '*.dll' \) -print0 \
+  | xargs -0 aas-sign sign --max-parallel 8 \
+                           --endpoint "$AAS_SIGN_ENDPOINT" \
+                           --account  "$AAS_SIGN_ACCOUNT" \
+                           --profile  "$AAS_SIGN_PROFILE"
 
 # Pack the (now-signed) toolchain.
 7z a -mx=9 -mtm=- w64devkit.7z "$PREFIX"
 
 # Concatenate the SFX prefix with the archive, then sign the result.
 cat /7z/7z.sfx w64devkit.7z >/w64devkit.7z.exe
-sign /w64devkit.7z.exe
+aas-sign sign --endpoint "$AAS_SIGN_ENDPOINT" \
+              --account  "$AAS_SIGN_ACCOUNT" \
+              --profile  "$AAS_SIGN_PROFILE" \
+              /w64devkit.7z.exe
 
 exec 1>&3 3>&-
 exec cat /w64devkit.7z.exe