diff --git a/fastlane/Fastfile b/fastlane/Fastfile
index c0bd806..fa0e6fe 100644
--- a/fastlane/Fastfile
+++ b/fastlane/Fastfile
@@ -93,6 +93,14 @@ platform :ios do
     )
   end
 
+  # CI signs headlessly, so match needs a fresh unlocked keychain to import
+  # into. codesign resolves identities through the user keychain search
+  # list (first match wins; the --keychain flag does not restrict the
+  # lookup), and other projects' keychains on this runner hold the same
+  # identity but are usually locked — so ours must come first. delete_keychain
+  # in the beta lane's ensure removes both the keychain and its search-list
+  # entry, which also keeps our (later locked) copy from shadowing those
+  # other projects.
   private_lane :prepare_ci_keychain do
     next unless ci?
 
@@ -102,9 +110,15 @@ platform :ios do
       password: CI_KEYCHAIN_PASSWORD,
       unlock: true,
       timeout: 3600,
-      add_to_search_list: true
+      add_to_search_list: false
     )
 
+    others = sh("security list-keychains -d user", log: false)
+      .scan(/"([^"]+)"/)
+      .flatten
+      .reject { |path| path.include?(CI_KEYCHAIN_NAME) }
+    sh("security list-keychains -d user -s #{([CI_KEYCHAIN_DB_PATH] + others).shelljoin}")
+
     ENV["MATCH_KEYCHAIN_NAME"] = CI_KEYCHAIN_NAME
     ENV["MATCH_KEYCHAIN_PASSWORD"] = CI_KEYCHAIN_PASSWORD
   end
@@ -166,5 +180,7 @@ platform :ios do
       api_key: api_key,
       skip_waiting_for_build_processing: true
     )
+  ensure
+    delete_keychain(name: CI_KEYCHAIN_NAME) if ci? && File.file?(CI_KEYCHAIN_DB_PATH)
   end
 end