diff --git a/src/custom-sign.js b/src/custom-sign.js
index 5dbdba5..0ea5ecb 100644
--- a/src/custom-sign.js
+++ b/src/custom-sign.js
@@ -8,6 +8,9 @@ exports.default = async function(configuration) {
         --alias "${process.env.KMS_ARN}" \
         --certfile "${process.env.CERT_PATH}" \
         --alg "SHA256" \
+        --tsaurl "http://timestamp.digicert.com" \
+        --tsretries 10 \
+        --replace \
         "${configuration.path}"
         `,
         { stdio: "inherit"}