diff --git a/CMakeLists.txt b/CMakeLists.txt
index 1e6138a..5505098 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -3,6 +3,13 @@ project(updater)
 cmake_minimum_required(VERSION 2.6)
 set(CMAKE_MODULE_PATH "${CMAKE_SOURCE_DIR}/cmake/modules")
 
+# If the SIGN_UPDATER option is enabled, the updater.exe
+# binary is digitally signed on Windows after it has been built.
+# A script called sign-updater.bat must exist in the PATH or
+# the directory where updater.exe is built.  This will be run
+# with the path of the binary to sign it.
+option(SIGN_UPDATER OFF)
+
 include_directories(external)
 include_directories(external/TinyThread/source)
 
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index b4e3c0e..222852e 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -118,5 +118,9 @@ target_link_libraries(updater
   updatershared
 )
 
+if (SIGN_UPDATER)
+	add_custom_command(TARGET updater POST_BUILD COMMAND sign-updater.bat updater.exe)
+endif()
+
 install(TARGETS updater RUNTIME DESTINATION bin)