diff --git a/.changeset/fluffy-dryers-enjoy.md b/.changeset/fluffy-dryers-enjoy.md
new file mode 100644
index 00000000000..f8e2f5bb5bf
--- /dev/null
+++ b/.changeset/fluffy-dryers-enjoy.md
@@ -0,0 +1,6 @@
+---
+"app-builder-lib": patch
+"builder-util-runtime": patch
+---
+
+fix: add MemoLazy to fix codeSigningInfo not responding to changed args
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 26046268dca..317d149ff23 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -18,7 +18,7 @@ jobs:
     strategy:
       matrix:
         testFiles:
-          - ArtifactPublisherTest,BuildTest,ExtraBuildTest,RepoSlugTest,binDownloadTest,configurationValidationTest,filenameUtilTest,filesTest,globTest,ignoreTest,macroExpanderTest,mainEntryTest,urlUtilTest,extraMetadataTest,linuxArchiveTest,linuxPackagerTest,HoistedNodeModuleTest
+          - ArtifactPublisherTest,BuildTest,ExtraBuildTest,RepoSlugTest,binDownloadTest,configurationValidationTest,filenameUtilTest,filesTest,globTest,ignoreTest,macroExpanderTest,mainEntryTest,urlUtilTest,extraMetadataTest,linuxArchiveTest,linuxPackagerTest,HoistedNodeModuleTest,MemoLazyTest
           - snapTest,debTest,fpmTest,protonTest
     steps:
       - name: Checkout code repository
diff --git a/docs/api/electron-builder.md b/docs/api/electron-builder.md
index 544c508623f..d7811869553 100644
--- a/docs/api/electron-builder.md
+++ b/docs/api/electron-builder.md
@@ -927,45 +927,69 @@ Developer API only. See [Configuration](../configuration/configuration.md) for u
 <strong>Properties</strong></p>
 <ul>
 <li>
-<p>**&lt;code id=&quot;MacPackager-[codeSigningInfo=new Lazy<CodeSigningInfo>(() =&gt; {
+<p>**&lt;code id=&quot;MacPackager-[codeSigningInfo=new MemoLazy&lt;CreateKeychainOptions | null, CodeSigningInfo&gt;(
+() =&gt; {
 const cscLink = this.getCscLink()
 if (cscLink == null || process.platform !== “darwin”) {
-return Promise.resolve({ keychainFile: process.env.CSC_KEYCHAIN || null })
+return null
 }</p>
-<p>return createKeychain({
-tmpDir: this.info.tempDirManager,
-cscLink,
-cscKeyPassword: this.getCscPassword(),
-cscILink: chooseNotNull(this.platformSpecificBuildOptions.cscInstallerLink, process.env.CSC_INSTALLER_LINK),
-cscIKeyPassword: chooseNotNull(this.platformSpecificBuildOptions.cscInstallerKeyPassword, process.env.CSC_INSTALLER_KEY_PASSWORD),
-currentDir: this.projectDir,
-}).then(result =&gt; {
+<pre><code class="hljs">const selected = {
+  tmpDir: this.info.tempDirManager,
+  cscLink,
+  cscKeyPassword: this.getCscPassword(),
+  cscILink: chooseNotNull(this.platformSpecificBuildOptions.cscInstallerLink, process.env.CSC_INSTALLER_LINK),
+  cscIKeyPassword: chooseNotNull(this.platformSpecificBuildOptions.cscInstallerKeyPassword, process.env.CSC_INSTALLER_KEY_PASSWORD),
+  currentDir: this.projectDir,
+}
+
+return selected
+</code></pre>
+<p>},
+async selected =&gt; {
+if (selected) {
+return createKeychain(selected).then(result =&gt; {
 const keychainFile = result.keychainFile
 if (keychainFile != null) {
 this.info.disposeOnBuildFinish(() =&gt; removeKeychain(keychainFile))
 }
 return result
 })
-})]&quot;&gt;[codeSigningInfo=new Lazy<CodeSigningInfo>(() =&gt; {
+}</p>
+<pre><code class="hljs">return Promise.resolve({ keychainFile: process.env.CSC_KEYCHAIN || null })
+</code></pre>
+<p>}
+)]&quot;&gt;[codeSigningInfo=new MemoLazy&lt;CreateKeychainOptions | null, CodeSigningInfo&gt;(
+() =&gt; {
 const cscLink = this.getCscLink()
 if (cscLink == null || process.platform !== “darwin”) {
-return Promise.resolve({ keychainFile: process.env.CSC_KEYCHAIN || null })
+return null
 }</p>
-<p>return createKeychain({
-tmpDir: this.info.tempDirManager,
-cscLink,
-cscKeyPassword: this.getCscPassword(),
-cscILink: chooseNotNull(this.platformSpecificBuildOptions.cscInstallerLink, process.env.CSC_INSTALLER_LINK),
-cscIKeyPassword: chooseNotNull(this.platformSpecificBuildOptions.cscInstallerKeyPassword, process.env.CSC_INSTALLER_KEY_PASSWORD),
-currentDir: this.projectDir,
-}).then(result =&gt; {
+<pre><code class="hljs">const selected = {
+  tmpDir: this.info.tempDirManager,
+  cscLink,
+  cscKeyPassword: this.getCscPassword(),
+  cscILink: chooseNotNull(this.platformSpecificBuildOptions.cscInstallerLink, process.env.CSC_INSTALLER_LINK),
+  cscIKeyPassword: chooseNotNull(this.platformSpecificBuildOptions.cscInstallerKeyPassword, process.env.CSC_INSTALLER_KEY_PASSWORD),
+  currentDir: this.projectDir,
+}
+
+return selected
+</code></pre>
+<p>},
+async selected =&gt; {
+if (selected) {
+return createKeychain(selected).then(result =&gt; {
 const keychainFile = result.keychainFile
 if (keychainFile != null) {
 this.info.disposeOnBuildFinish(() =&gt; removeKeychain(keychainFile))
 }
 return result
 })
-})]</code>** Lazy&lt;module:app-builder-lib/out/codeSign/macCodeSign.CodeSigningInfo&gt;</p>
+}</p>
+<pre><code class="hljs">return Promise.resolve({ keychainFile: process.env.CSC_KEYCHAIN || null })
+</code></pre>
+<p>}
+)]</code>** MemoLazy&lt; | module:app-builder-lib/out/codeSign/macCodeSign.CreateKeychainOptions | module:app-builder-lib/out/codeSign/macCodeSign.CodeSigningInfo&gt;</p>
 </li>
 <li>
 <p><strong><code id="MacPackager-defaultTarget">defaultTarget</code></strong> Array&lt;String&gt;</p>
@@ -2217,8 +2241,9 @@ return path.join(target.outDir, <code>__${target.name}-${getArtifactArchName(arc
 <strong>Properties</strong></p>
 <ul>
 <li>
-<p>**&lt;code id=&quot;WinPackager-[cscInfo=new Lazy&lt;FileCodeSigningInfo | CertificateFromStoreInfo | null&gt;(() =&gt; {
-const platformSpecificBuildOptions = this.platformSpecificBuildOptions
+<p>**&lt;code id=&quot;WinPackager-[cscInfo=new MemoLazy&lt;WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null&gt;(
+() =&gt; this.platformSpecificBuildOptions,
+platformSpecificBuildOptions =&gt; {
 if (platformSpecificBuildOptions.certificateSubjectName != null || platformSpecificBuildOptions.certificateSha1 != null) {
 return this.vm.value
 .then(vm =&gt; getCertificateFromStoreInfo(platformSpecificBuildOptions, vm))
@@ -2232,37 +2257,42 @@ return null
 }
 })
 }</p>
-<p>const certificateFile = platformSpecificBuildOptions.certificateFile
+<pre><code class="hljs">const certificateFile = platformSpecificBuildOptions.certificateFile
 if (certificateFile != null) {
-const certificatePassword = this.getCscPassword()
-return Promise.resolve({
-file: certificateFile,
-password: certificatePassword == null ? null : certificatePassword.trim(),
-})
-}</p>
-<p>const cscLink = this.getCscLink(“WIN_CSC_LINK”)
-if (cscLink == null || cscLink === “”) {
-return Promise.resolve(null)
-}</p>
-<p>return (
-importCertificate(cscLink, this.info.tempDirManager, this.projectDir)
-// before then
-.catch((e: any) =&gt; {
-if (e instanceof InvalidConfigurationError) {
-throw new InvalidConfigurationError(<code>Env WIN_CSC_LINK is not correct, cannot resolve: ${e.message}</code>)
-} else {
-throw e
+  const certificatePassword = this.getCscPassword()
+  return Promise.resolve({
+    file: certificateFile,
+    password: certificatePassword == null ? null : certificatePassword.trim(),
+  })
 }
-})
-.then(path =&gt; {
-return {
-file: path,
-password: this.getCscPassword(),
+
+const cscLink = this.getCscLink(&quot;WIN_CSC_LINK&quot;)
+if (cscLink == null || cscLink === &quot;&quot;) {
+  return Promise.resolve(null)
 }
-})
+
+return (
+  importCertificate(cscLink, this.info.tempDirManager, this.projectDir)
+    // before then
+    .catch((e: any) =&gt; {
+      if (e instanceof InvalidConfigurationError) {
+        throw new InvalidConfigurationError(`Env WIN_CSC_LINK is not correct, cannot resolve: ${e.message}`)
+      } else {
+        throw e
+      }
+    })
+    .then(path =&gt; {
+      return {
+        file: path,
+        password: this.getCscPassword(),
+      }
+    })
 )
-})]&quot;&gt;[cscInfo=new Lazy&lt;FileCodeSigningInfo | CertificateFromStoreInfo | null&gt;(() =&gt; {
-const platformSpecificBuildOptions = this.platformSpecificBuildOptions
+</code></pre>
+<p>}
+)]&quot;&gt;[cscInfo=new MemoLazy&lt;WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null&gt;(
+() =&gt; this.platformSpecificBuildOptions,
+platformSpecificBuildOptions =&gt; {
 if (platformSpecificBuildOptions.certificateSubjectName != null || platformSpecificBuildOptions.certificateSha1 != null) {
 return this.vm.value
 .then(vm =&gt; getCertificateFromStoreInfo(platformSpecificBuildOptions, vm))
@@ -2276,36 +2306,40 @@ return null
 }
 })
 }</p>
-<p>const certificateFile = platformSpecificBuildOptions.certificateFile
+<pre><code class="hljs">const certificateFile = platformSpecificBuildOptions.certificateFile
 if (certificateFile != null) {
-const certificatePassword = this.getCscPassword()
-return Promise.resolve({
-file: certificateFile,
-password: certificatePassword == null ? null : certificatePassword.trim(),
-})
-}</p>
-<p>const cscLink = this.getCscLink(“WIN_CSC_LINK”)
-if (cscLink == null || cscLink === “”) {
-return Promise.resolve(null)
-}</p>
-<p>return (
-importCertificate(cscLink, this.info.tempDirManager, this.projectDir)
-// before then
-.catch((e: any) =&gt; {
-if (e instanceof InvalidConfigurationError) {
-throw new InvalidConfigurationError(<code>Env WIN_CSC_LINK is not correct, cannot resolve: ${e.message}</code>)
-} else {
-throw e
+  const certificatePassword = this.getCscPassword()
+  return Promise.resolve({
+    file: certificateFile,
+    password: certificatePassword == null ? null : certificatePassword.trim(),
+  })
 }
-})
-.then(path =&gt; {
-return {
-file: path,
-password: this.getCscPassword(),
+
+const cscLink = this.getCscLink(&quot;WIN_CSC_LINK&quot;)
+if (cscLink == null || cscLink === &quot;&quot;) {
+  return Promise.resolve(null)
 }
-})
+
+return (
+  importCertificate(cscLink, this.info.tempDirManager, this.projectDir)
+    // before then
+    .catch((e: any) =&gt; {
+      if (e instanceof InvalidConfigurationError) {
+        throw new InvalidConfigurationError(`Env WIN_CSC_LINK is not correct, cannot resolve: ${e.message}`)
+      } else {
+        throw e
+      }
+    })
+    .then(path =&gt; {
+      return {
+        file: path,
+        password: this.getCscPassword(),
+      }
+    })
 )
-})]</code>** Lazy&lt; | <a href="#FileCodeSigningInfo">FileCodeSigningInfo</a> | <a href="#CertificateFromStoreInfo">CertificateFromStoreInfo</a>&gt;</p>
+</code></pre>
+<p>}
+)]</code>** MemoLazy&lt;<a href="#WindowsConfiguration">WindowsConfiguration</a> |  | <a href="#FileCodeSigningInfo">FileCodeSigningInfo</a> | <a href="#CertificateFromStoreInfo">CertificateFromStoreInfo</a>&gt;</p>
 </li>
 <li>
 <p><code id="WinPackager-vm">vm</code> = <code>new Lazy&lt;VmManager&gt;(() =&gt; (process.platform === &quot;win32&quot; ? Promise.resolve(new VmManager()) : getWindowsVm(this.debugLogger)))</code> Lazy&lt;module:app-builder-lib/out/vm/vm.VmManager&gt;</p>
@@ -2332,41 +2366,51 @@ return certInfo == null ? null : [certInfo.commonName]
 })]</code>** Lazy&lt; | Array&gt;</p>
 </li>
 <li>
-<p>**&lt;code id=&quot;WinPackager-[lazyCertInfo=new Lazy&lt;CertificateInfo | null&gt;(async () =&gt; {
-const cscInfo = await this.cscInfo.value
+<p>**&lt;code id=&quot;WinPackager-[lazyCertInfo=new MemoLazy&lt;MemoLazy&lt;WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null&gt;, CertificateInfo | null&gt;(
+() =&gt; this.cscInfo,
+async csc =&gt; {
+const cscInfo = await csc.value
 if (cscInfo == null) {
 return null
 }</p>
-<p>if (“subject” in cscInfo) {
-const bloodyMicrosoftSubjectDn = cscInfo.subject
-return {
-commonName: parseDn(bloodyMicrosoftSubjectDn).get(“CN”)!,
-bloodyMicrosoftSubjectDn,
+<pre><code class="hljs">if (&quot;subject&quot; in cscInfo) {
+  const bloodyMicrosoftSubjectDn = cscInfo.subject
+  return {
+    commonName: parseDn(bloodyMicrosoftSubjectDn).get(&quot;CN&quot;)!,
+    bloodyMicrosoftSubjectDn,
+  }
 }
-}</p>
-<p>const cscFile = cscInfo.file
+
+const cscFile = cscInfo.file
 if (cscFile == null) {
-return null
+  return null
 }
-return await getCertInfo(cscFile, cscInfo.password || “”)
-})]&quot;&gt;[lazyCertInfo=new Lazy&lt;CertificateInfo | null&gt;(async () =&gt; {
-const cscInfo = await this.cscInfo.value
+return await getCertInfo(cscFile, cscInfo.password || &quot;&quot;)
+</code></pre>
+<p>}
+)]&quot;&gt;[lazyCertInfo=new MemoLazy&lt;MemoLazy&lt;WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null&gt;, CertificateInfo | null&gt;(
+() =&gt; this.cscInfo,
+async csc =&gt; {
+const cscInfo = await csc.value
 if (cscInfo == null) {
 return null
 }</p>
-<p>if (“subject” in cscInfo) {
-const bloodyMicrosoftSubjectDn = cscInfo.subject
-return {
-commonName: parseDn(bloodyMicrosoftSubjectDn).get(“CN”)!,
-bloodyMicrosoftSubjectDn,
+<pre><code class="hljs">if (&quot;subject&quot; in cscInfo) {
+  const bloodyMicrosoftSubjectDn = cscInfo.subject
+  return {
+    commonName: parseDn(bloodyMicrosoftSubjectDn).get(&quot;CN&quot;)!,
+    bloodyMicrosoftSubjectDn,
+  }
 }
-}</p>
-<p>const cscFile = cscInfo.file
+
+const cscFile = cscInfo.file
 if (cscFile == null) {
-return null
+  return null
 }
-return await getCertInfo(cscFile, cscInfo.password || “”)
-})]</code>** Lazy&lt; | module:app-builder-lib/out/codeSign/windowsCodeSign.CertificateInfo&gt;</p>
+return await getCertInfo(cscFile, cscInfo.password || &quot;&quot;)
+</code></pre>
+<p>}
+)]</code>** MemoLazy&lt;MemoLazy&lt;<a href="#WindowsConfiguration">WindowsConfiguration</a> |  | <a href="#FileCodeSigningInfo">FileCodeSigningInfo</a> | <a href="#CertificateFromStoreInfo">CertificateFromStoreInfo</a>&gt; |  | module:app-builder-lib/out/codeSign/windowsCodeSign.CertificateInfo&gt;</p>
 </li>
 <li>
 <p><strong><code id="WinPackager-isForceCodeSigningVerification">isForceCodeSigningVerification</code></strong> Boolean</p>
diff --git a/packages/app-builder-lib/src/macPackager.ts b/packages/app-builder-lib/src/macPackager.ts
index 0a94c313115..4ae860fbcb3 100644
--- a/packages/app-builder-lib/src/macPackager.ts
+++ b/packages/app-builder-lib/src/macPackager.ts
@@ -7,7 +7,7 @@ import * as path from "path"
 import { copyFile, statOrNull, unlinkIfExists } from "builder-util/out/fs"
 import { orIfFileNotExist } from "builder-util/out/promise"
 import { AppInfo } from "./appInfo"
-import { CertType, CodeSigningInfo, createKeychain, findIdentity, Identity, isSignAllowed, removeKeychain, reportError, sign } from "./codeSign/macCodeSign"
+import { CertType, CodeSigningInfo, createKeychain, CreateKeychainOptions, findIdentity, Identity, isSignAllowed, removeKeychain, reportError, sign } from "./codeSign/macCodeSign"
 import { DIR_TARGET, Platform, Target } from "./core"
 import { AfterPackContext, ElectronPlatformName } from "./index"
 import { MacConfiguration, MasConfiguration, NotarizeNotaryOptions } from "./options/macOptions"
@@ -21,32 +21,44 @@ import { getTemplatePath } from "./util/pathManager"
 import * as fs from "fs/promises"
 import { notarize } from "@electron/notarize"
 import { NotarizeOptionsNotaryTool, NotaryToolKeychainCredentials } from "@electron/notarize/lib/types"
+import { MemoLazy } from "builder-util-runtime"
 
 export type CustomMacSignOptions = SignOptions
 export type CustomMacSign = (configuration: CustomMacSignOptions, packager: MacPackager) => Promise<void>
 
 export class MacPackager extends PlatformPackager<MacConfiguration> {
-  readonly codeSigningInfo = new Lazy<CodeSigningInfo>(() => {
-    const cscLink = this.getCscLink()
-    if (cscLink == null || process.platform !== "darwin") {
-      return Promise.resolve({ keychainFile: process.env.CSC_KEYCHAIN || null })
-    }
+  readonly codeSigningInfo = new MemoLazy<CreateKeychainOptions | null, CodeSigningInfo>(
+    () => {
+      const cscLink = this.getCscLink()
+      if (cscLink == null || process.platform !== "darwin") {
+        return null
+      }
 
-    return createKeychain({
-      tmpDir: this.info.tempDirManager,
-      cscLink,
-      cscKeyPassword: this.getCscPassword(),
-      cscILink: chooseNotNull(this.platformSpecificBuildOptions.cscInstallerLink, process.env.CSC_INSTALLER_LINK),
-      cscIKeyPassword: chooseNotNull(this.platformSpecificBuildOptions.cscInstallerKeyPassword, process.env.CSC_INSTALLER_KEY_PASSWORD),
-      currentDir: this.projectDir,
-    }).then(result => {
-      const keychainFile = result.keychainFile
-      if (keychainFile != null) {
-        this.info.disposeOnBuildFinish(() => removeKeychain(keychainFile))
+      const selected = {
+        tmpDir: this.info.tempDirManager,
+        cscLink,
+        cscKeyPassword: this.getCscPassword(),
+        cscILink: chooseNotNull(this.platformSpecificBuildOptions.cscInstallerLink, process.env.CSC_INSTALLER_LINK),
+        cscIKeyPassword: chooseNotNull(this.platformSpecificBuildOptions.cscInstallerKeyPassword, process.env.CSC_INSTALLER_KEY_PASSWORD),
+        currentDir: this.projectDir,
       }
-      return result
-    })
-  })
+
+      return selected
+    },
+    async selected => {
+      if (selected) {
+        return createKeychain(selected).then(result => {
+          const keychainFile = result.keychainFile
+          if (keychainFile != null) {
+            this.info.disposeOnBuildFinish(() => removeKeychain(keychainFile))
+          }
+          return result
+        })
+      }
+
+      return Promise.resolve({ keychainFile: process.env.CSC_KEYCHAIN || null })
+    }
+  )
 
   private _iconPath = new Lazy(() => this.getOrConvertIcon("icns"))
 
diff --git a/packages/app-builder-lib/src/winPackager.ts b/packages/app-builder-lib/src/winPackager.ts
index 3f221128efc..4da950521e9 100644
--- a/packages/app-builder-lib/src/winPackager.ts
+++ b/packages/app-builder-lib/src/winPackager.ts
@@ -1,6 +1,6 @@
 import BluebirdPromise from "bluebird-lst"
 import { Arch, asArray, InvalidConfigurationError, log, use, executeAppBuilder } from "builder-util"
-import { parseDn } from "builder-util-runtime"
+import { MemoLazy, parseDn } from "builder-util-runtime"
 import { CopyFileTransformer, FileTransformer, walk } from "builder-util/out/fs"
 import { createHash } from "crypto"
 import { readdir } from "fs/promises"
@@ -37,54 +37,56 @@ import { getWindowsVm, VmManager } from "./vm/vm"
 import { execWine } from "./wine"
 
 export class WinPackager extends PlatformPackager<WindowsConfiguration> {
-  readonly cscInfo = new Lazy<FileCodeSigningInfo | CertificateFromStoreInfo | null>(() => {
-    const platformSpecificBuildOptions = this.platformSpecificBuildOptions
-    if (platformSpecificBuildOptions.certificateSubjectName != null || platformSpecificBuildOptions.certificateSha1 != null) {
-      return this.vm.value
-        .then(vm => getCertificateFromStoreInfo(platformSpecificBuildOptions, vm))
-        .catch((e: any) => {
-          // https://github.com/electron-userland/electron-builder/pull/2397
-          if (platformSpecificBuildOptions.sign == null) {
-            throw e
-          } else {
-            log.debug({ error: e }, "getCertificateFromStoreInfo error")
-            return null
-          }
+  readonly cscInfo = new MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>(
+    () => this.platformSpecificBuildOptions,
+    platformSpecificBuildOptions => {
+      if (platformSpecificBuildOptions.certificateSubjectName != null || platformSpecificBuildOptions.certificateSha1 != null) {
+        return this.vm.value
+          .then(vm => getCertificateFromStoreInfo(platformSpecificBuildOptions, vm))
+          .catch((e: any) => {
+            // https://github.com/electron-userland/electron-builder/pull/2397
+            if (platformSpecificBuildOptions.sign == null) {
+              throw e
+            } else {
+              log.debug({ error: e }, "getCertificateFromStoreInfo error")
+              return null
+            }
+          })
+      }
+
+      const certificateFile = platformSpecificBuildOptions.certificateFile
+      if (certificateFile != null) {
+        const certificatePassword = this.getCscPassword()
+        return Promise.resolve({
+          file: certificateFile,
+          password: certificatePassword == null ? null : certificatePassword.trim(),
         })
-    }
+      }
 
-    const certificateFile = platformSpecificBuildOptions.certificateFile
-    if (certificateFile != null) {
-      const certificatePassword = this.getCscPassword()
-      return Promise.resolve({
-        file: certificateFile,
-        password: certificatePassword == null ? null : certificatePassword.trim(),
-      })
-    }
+      const cscLink = this.getCscLink("WIN_CSC_LINK")
+      if (cscLink == null || cscLink === "") {
+        return Promise.resolve(null)
+      }
 
-    const cscLink = this.getCscLink("WIN_CSC_LINK")
-    if (cscLink == null || cscLink === "") {
-      return Promise.resolve(null)
+      return (
+        importCertificate(cscLink, this.info.tempDirManager, this.projectDir)
+          // before then
+          .catch((e: any) => {
+            if (e instanceof InvalidConfigurationError) {
+              throw new InvalidConfigurationError(`Env WIN_CSC_LINK is not correct, cannot resolve: ${e.message}`)
+            } else {
+              throw e
+            }
+          })
+          .then(path => {
+            return {
+              file: path,
+              password: this.getCscPassword(),
+            }
+          })
+      )
     }
-
-    return (
-      importCertificate(cscLink, this.info.tempDirManager, this.projectDir)
-        // before then
-        .catch((e: any) => {
-          if (e instanceof InvalidConfigurationError) {
-            throw new InvalidConfigurationError(`Env WIN_CSC_LINK is not correct, cannot resolve: ${e.message}`)
-          } else {
-            throw e
-          }
-        })
-        .then(path => {
-          return {
-            file: path,
-            password: this.getCscPassword(),
-          }
-        })
-    )
-  })
+  )
 
   private _iconPath = new Lazy(() => this.getOrConvertIcon("ico"))
 
@@ -102,26 +104,29 @@ export class WinPackager extends PlatformPackager<WindowsConfiguration> {
     return certInfo == null ? null : [certInfo.commonName]
   })
 
-  readonly lazyCertInfo = new Lazy<CertificateInfo | null>(async () => {
-    const cscInfo = await this.cscInfo.value
-    if (cscInfo == null) {
-      return null
-    }
+  readonly lazyCertInfo = new MemoLazy<MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>, CertificateInfo | null>(
+    () => this.cscInfo,
+    async csc => {
+      const cscInfo = await csc.value
+      if (cscInfo == null) {
+        return null
+      }
 
-    if ("subject" in cscInfo) {
-      const bloodyMicrosoftSubjectDn = cscInfo.subject
-      return {
-        commonName: parseDn(bloodyMicrosoftSubjectDn).get("CN")!,
-        bloodyMicrosoftSubjectDn,
+      if ("subject" in cscInfo) {
+        const bloodyMicrosoftSubjectDn = cscInfo.subject
+        return {
+          commonName: parseDn(bloodyMicrosoftSubjectDn).get("CN")!,
+          bloodyMicrosoftSubjectDn,
+        }
       }
-    }
 
-    const cscFile = cscInfo.file
-    if (cscFile == null) {
-      return null
+      const cscFile = cscInfo.file
+      if (cscFile == null) {
+        return null
+      }
+      return await getCertInfo(cscFile, cscInfo.password || "")
     }
-    return await getCertInfo(cscFile, cscInfo.password || "")
-  })
+  )
 
   get isForceCodeSigningVerification(): boolean {
     return this.platformSpecificBuildOptions.verifyUpdateCodeSignature !== false
diff --git a/packages/builder-util-runtime/src/MemoLazy.ts b/packages/builder-util-runtime/src/MemoLazy.ts
new file mode 100644
index 00000000000..bef7b9f90ee
--- /dev/null
+++ b/packages/builder-util-runtime/src/MemoLazy.ts
@@ -0,0 +1,47 @@
+export class MemoLazy<S, V> {
+  private selected: S | undefined = undefined
+  private _value: Promise<V> | undefined = undefined
+
+  constructor(
+    private selector: () => S,
+    private creator: (selected: S) => Promise<V>
+  ) {}
+
+  get hasValue() {
+    return this._value !== undefined
+  }
+
+  get value(): Promise<V> {
+    const selected = this.selector()
+    if (this._value !== undefined && equals(this.selected, selected)) {
+      // value exists and selected hasn't changed, so return the cached value
+      return this._value
+    }
+
+    this.selected = selected
+    const result = this.creator(selected)
+    this.value = result
+
+    return result
+  }
+
+  set value(value: Promise<V>) {
+    this._value = value
+  }
+}
+
+function equals(firstValue: any, secondValue: any): boolean {
+  const isFirstObject = typeof firstValue === "object" && firstValue !== null
+  const isSecondObject = typeof secondValue === "object" && secondValue !== null
+
+  // do a shallow comparison of objects, arrays etc.
+  if (isFirstObject && isSecondObject) {
+    const keys1 = Object.keys(firstValue)
+    const keys2 = Object.keys(secondValue)
+
+    return keys1.length === keys2.length && keys1.every((key: any) => equals(firstValue[key], secondValue[key]))
+  }
+
+  // otherwise just compare the values directly
+  return firstValue === secondValue
+}
diff --git a/packages/builder-util-runtime/src/index.ts b/packages/builder-util-runtime/src/index.ts
index c29ea8b48ff..c6c793f2be9 100644
--- a/packages/builder-util-runtime/src/index.ts
+++ b/packages/builder-util-runtime/src/index.ts
@@ -36,6 +36,7 @@ export { ProgressCallbackTransform, ProgressInfo } from "./ProgressCallbackTrans
 export { parseXml, XElement } from "./xml"
 export { BlockMap } from "./blockMapApi"
 export { newError } from "./error"
+export { MemoLazy } from "./MemoLazy"
 
 // nsis
 export const CURRENT_APP_INSTALLER_FILE_NAME = "installer.exe"
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 180f7aec9b3..7feba36f277 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -284,7 +284,7 @@ importers:
         version: 4.1.7
       app-builder-bin:
         specifier: v5.0.0-alpha.4
-        version: 5.0.0-alpha.3
+        version: 5.0.0-alpha.4
       bluebird-lst:
         specifier: ^1.0.9
         version: 1.0.9
@@ -611,6 +611,9 @@ importers:
       js-yaml:
         specifier: ^4.1.0
         version: 4.1.0
+      lazy-val:
+        specifier: ^1.0.5
+        version: 1.0.5
       path-sort:
         specifier: ^0.1.0
         version: 0.1.0
@@ -3594,8 +3597,8 @@ packages:
       normalize-path: 3.0.0
       picomatch: 2.3.1
 
-  /app-builder-bin@5.0.0-alpha.3:
-    resolution: {integrity: sha512-bWTAF50v4ZAVLq6EPZYhaLsFSJLfZz5s9MIeP5k1RkkBsibyJV/Dv6NxfaDO0I++iBmcLKsuzB5E8b1qaeXqew==}
+  /app-builder-bin@5.0.0-alpha.4:
+    resolution: {integrity: sha512-4MitKmOtfTdMONrtRoiaqJ6HtlVZXgrNX1PNdEzEHSAoXU85x7s+mo0IhAS9K9qgjyTVuLrM1E/HAMp5qGyoOA==}
     dev: false
 
   /aproba@2.0.0:
diff --git a/test/package.json b/test/package.json
index 756f491f967..df1a208197a 100644
--- a/test/package.json
+++ b/test/package.json
@@ -21,6 +21,7 @@
     "jest": "^27.5.1",
     "jest-junit": "^12.0.0",
     "js-yaml": "^4.1.0",
+    "lazy-val": "^1.0.5",
     "path-sort": "^0.1.0",
     "semver": "^7.3.8",
     "stat-mode": "^1.0.0",
diff --git a/test/src/MemoLazyTest.ts b/test/src/MemoLazyTest.ts
new file mode 100644
index 00000000000..3c8511e999f
--- /dev/null
+++ b/test/src/MemoLazyTest.ts
@@ -0,0 +1,46 @@
+import { MemoLazy } from "builder-util-runtime"
+import { Lazy } from "lazy-val"
+
+test("[Lazy] reuses the created value even if the selected value has changed", async () => {
+  let selectedValue = 0
+  const lazy = new Lazy(() => {
+    return Promise.resolve(selectedValue * 10)
+  })
+
+  selectedValue++
+  expect(await lazy.value).toBe(10)
+
+  selectedValue++
+  expect(await lazy.value).toBe(10)
+})
+
+test("[MemoLazy] recomputes the created value if the selected value has changed", async () => {
+  let selectedValue = 0
+  const lazy = new MemoLazy(
+    () => selectedValue,
+    selectedValue => {
+      return Promise.resolve(selectedValue * 10)
+    }
+  )
+
+  selectedValue++
+  expect(await lazy.value).toBe(10)
+
+  selectedValue++
+  expect(await lazy.value).toBe(20)
+})
+
+test("[MemoLazy] recomputes the created value if the selected deep/internal value has changed", async () => {
+  let selectedValue = { deep: { property: { here: 0 } } }
+  const lazy = new MemoLazy(
+    () => selectedValue,
+    selectedValue => {
+      return Promise.resolve(selectedValue.deep.property.here)
+    }
+  )
+
+  expect(await lazy.value).toBe(0)
+
+  selectedValue = { deep: { property: { here: 10 } } }
+  expect(await lazy.value).toBe(10)
+})