diff --git a/changelog.d/+use_sha384_for_win_sign.infrastructure.md b/changelog.d/+use_sha384_for_win_sign.infrastructure.md
new file mode 100644
index 00000000..67a18074
--- /dev/null
+++ b/changelog.d/+use_sha384_for_win_sign.infrastructure.md
@@ -0,0 +1 @@
+Use SHA384 for Windows signing instead of expired SHA256withRSA.
diff --git a/noxfile.py b/noxfile.py
index cf68d672..ec523521 100644
--- a/noxfile.py
+++ b/noxfile.py
@@ -363,9 +363,9 @@ def sign_windows(cert_file, cert_password):
                 '/tr',
                 WINDOWS_TIMESTAMP_SERVER,
                 '/td',
-                'sha256',
+                'sha384',
                 '/fd',
-                'sha256',
+                'sha384',
                 f'dist/{binary_name}.exe',
                 external=True,
             )