diff --git a/.github/workflows/build-ios-testflight.yml b/.github/workflows/build-ios-testflight.yml
index 8f63cda4c..d03f20e80 100644
--- a/.github/workflows/build-ios-testflight.yml
+++ b/.github/workflows/build-ios-testflight.yml
@@ -256,15 +256,36 @@ jobs:
           security unlock-keychain -p "$APPLE_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
           # Add to user search list so codesign can find it
           security list-keychains -d user -s "$KEYCHAIN_PATH" $(security list-keychains -d user | sed 's/"//g')
-          # Import the .p12
-          P12="$RUNNER_TEMP/dist.p12"
-          echo "$APPLE_DIST_CERT_P12_BASE64" | openssl base64 -d -A > "$P12"
+          # Decode the user-uploaded .p12 to disk.
+          P12_MODERN="$RUNNER_TEMP/dist-modern.p12"
+          echo "$APPLE_DIST_CERT_P12_BASE64" | openssl base64 -d -A > "$P12_MODERN"
+          echo "=== uploaded .p12 file ==="
+          ls -la "$P12_MODERN"
+          xxd "$P12_MODERN" | head -1
+          file "$P12_MODERN" || true
+
+          # macOS Keychain Access in Sonoma+ exports .p12 with modern crypto
+          # (AES-256-GCM + PBKDF2 + SHA-256) that the `security import`
+          # binary on some macOS releases rejects with
+          # "SecKeychainItemImport: Unknown format in import." Re-export
+          # the PKCS12 through openssl using legacy PBE-SHA1-3DES so the
+          # macOS security command can definitely parse it.
+          P12="$RUNNER_TEMP/dist-legacy.p12"
+          echo "=== converting to legacy PKCS12 format ==="
+          openssl pkcs12 -in "$P12_MODERN" -nodes \
+              -password pass:"$APPLE_DIST_CERT_P12_PASSWORD" \
+            | openssl pkcs12 -export \
+              -macalg sha1 -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES \
+              -password pass:"$APPLE_DIST_CERT_P12_PASSWORD" \
+              -out "$P12"
+          ls -la "$P12"
+
           security import "$P12" -k "$KEYCHAIN_PATH" -P "$APPLE_DIST_CERT_P12_PASSWORD" \
             -T /usr/bin/codesign -T /usr/bin/security
           security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$APPLE_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
           # Sanity-check: list identities the keychain offers
           security find-identity -v -p codesigning "$KEYCHAIN_PATH"
-          rm -f "$P12"
+          rm -f "$P12_MODERN" "$P12"
 
       - name: Install provisioning profile + parse name/UUID for ExportOptions
         env: