diff --git a/mcp-extension/README.md b/mcp-extension/README.md
index b65bb81..f2841c1 100644
--- a/mcp-extension/README.md
+++ b/mcp-extension/README.md
@@ -84,11 +84,19 @@ npx -y @anthropic-ai/mcpb validate manifest.json
 npx -y @anthropic-ai/mcpb info ms-todo.mcpb
 ```
 
-### Optional: sign the extension
+### Signing — currently disabled
 
-Unsigned extensions install with a "not verified" warning. You can self-sign so
-the warning shows your identity (full removal of the warning needs a CA-issued
-cert your org trusts):
+Unsigned extensions install with a "not verified" warning, which is fine for
+internal distribution (just click through it).
+
+> ⚠️ **Do not sign with `mcpb sign` right now.** As of `@anthropic-ai/mcpb` 2.1.2
+> (and 2.0.x/2.1.x), `sign` corrupts the bundle: it writes an invalid ZIP EOCD
+> comment length, so Claude Desktop fails to open it ("Invalid comment length …
+> extra bytes at the end of the file") and `mcpb verify` reports it as unsigned.
+> Ship the **unsigned** bundle until this is fixed upstream.
+
+When signing works again (or with a CA-trusted cert deployed to your fleet), the
+command is:
 
 ```bash
 npx -y @anthropic-ai/mcpb sign ms-todo.mcpb --cert cert.pem --key key.pem