How to sign Update.exe?

I'm using electron-winstaller to package my electron application, but I can't code sign Update.exe, because my sign process is upload the binary files to code sign server, and the Update.exe is not available during the build and package process, so I can't upload it to the server to sign.

I found the sign mechanism of electron-winstaller is pass the cetificate file path and password to the signWithParams parameter, but I can't get the cetificate file to my build machine. Is there any mehod to do code sign for my scenarios?