diff --git a/windows-release/azure-pipelines.yml b/windows-release/azure-pipelines.yml
index c4460195..4b837c0c 100644
--- a/windows-release/azure-pipelines.yml
+++ b/windows-release/azure-pipelines.yml
@@ -135,8 +135,10 @@ resources:
 variables:
   ${{ if ne(parameters.GitRemote, '(Other)') }}:
     GitRemote: ${{ parameters.GitRemote }}
+    GitRemoteIsOther: false
   ${{ else }}:
     GitRemote: ${{ parameters.GitRemote_Other }}
+    GitRemoteIsOther: true
   SourceTag: ${{ parameters.SourceTag }}
   ${{ if ne(parameters.SourceCommit, 'empty') }}:
     SourceCommit: ${{ parameters.SourceCommit }}
diff --git a/windows-release/stage-sign.yml b/windows-release/stage-sign.yml
index a611e424..953e763f 100644
--- a/windows-release/stage-sign.yml
+++ b/windows-release/stage-sign.yml
@@ -35,6 +35,11 @@ jobs:
       - group: CPythonTestSign
 
     steps:
+    - powershell: |
+        throw "Production signing certificate requires SourceCommit and non-other GitRemote ('$(SourceCommit)' '$(GitRemote)')"
+      displayName: "Check 'SourceCommit' and 'GitRemoteIsOther' when using production signing certificate"
+      condition: and(succeeded(), or(not(IsRealSigned), and(variables['SourceCommit'], not(variables['GitRemoteIsOther']))))
+
     - template: ./checkout.yml
 
     - powershell: |