diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index 9241e8f789..94545d4ccd 100644
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -154,10 +154,10 @@ nothing; results are in the job log and step summary. Run
 it locally (`PULSE_REHEARSAL_ENGINE=podman` on hosts without Docker).
 
 `release-signing-preflight.yml` checks that the macOS release signing path
-would work, without building or publishing anything. It runs on manual
-dispatch from `main`; the nightly release rehearsal that used to dispatch it
-was switched off with the release steward on 4 October 2026. On a `macos-15`
-runner it imports
+would work, without building or publishing anything. It runs every Monday at
+06:23 UTC and on manual dispatch from `main`. The schedule replaces the nightly
+release rehearsal that dispatched it until that rehearsal was switched off with
+the release steward on 4 October 2026. On a `macos-15` runner it imports
 the Developer ID certificate into a throwaway keychain, requires the configured
 identity to be valid for code signing and at least 30 days from expiry, signs
 and verifies a probe binary with a secure timestamp, and reads the Apple notary
diff --git a/.github/workflows/release-signing-preflight.yml b/.github/workflows/release-signing-preflight.yml
index e00158f08f..5c818c9f7d 100644
--- a/.github/workflows/release-signing-preflight.yml
+++ b/.github/workflows/release-signing-preflight.yml
@@ -3,16 +3,20 @@ name: Release Signing Preflight
 # the dispatch answer is lost.
 run-name: ${{ format('Release signing preflight (no release build or publication){0}', inputs.request_id && format(' [{0}]', inputs.request_id) || '') }}
 
-# Dispatch this from main to find a lapsed Apple developer agreement, a revoked
-# notary key or an expiring Developer ID certificate before a release candidate
-# fails on it. The maintainer's nightly release rehearsal (pulse-dev-infra
+# This finds a lapsed Apple developer agreement, a revoked notary key or an
+# expiring Developer ID certificate before a release candidate fails on it. It
+# runs every Monday and can be dispatched from main at any time. The
+# maintainer's nightly release rehearsal (pulse-dev-infra
 # pulse-maintainer-release-rehearsal) dispatched it until that rehearsal was
-# switched off with the release steward on 4 October 2026.
+# switched off with the release steward on 4 October 2026. The weekly schedule
+# replaces it, and the certificate check's 30-day margin leaves weeks to renew.
 # On 2 Oct 2026 v6.4.6-rc.1 failed notarization because the agreement was
 # unsigned. This signs only a throwaway probe binary on the runner; it builds,
 # notarizes, uploads and publishes nothing. The certificate and notary checks
 # are independent, so one run names every broken credential.
 on:
+  schedule:
+    - cron: '23 6 * * 1'
   workflow_dispatch:
     inputs:
       request_id: