  		if (confpath != NULL ||
  		    certpath != NULL ||
 diff --git a/src/update_handler.c b/src/update_handler.c
-index 95ca24b9d7fd57a3dbd4f7f5568c09deae8c1bed..024f5e58b197270f213cee995b2efa03a39a84bf 100644
+index bcd6fd8..47ef4e8 100644
 --- a/src/update_handler.c
 +++ b/src/update_handler.c
-@@ -632,7 +632,7 @@ static gboolean run_slot_hook(const gchar *hook_name, const gchar *hook_cmd, Rau
- 	}
+@@ -685,7 +685,7 @@ static gboolean run_slot_hook(const gchar *hook_name, const gchar *hook_cmd, Rau
  	g_subprocess_launcher_setenv(launcher, "RAUC_MOUNT_PREFIX", r_context()->config->mount_prefix, TRUE);
- 
--	if (r_context()->install_info->mounted_bundle) {
-+	if (r_context()->install_info->mounted_bundle && r_context()->install_info->mounted_bundle->verified_chain) {
+
+ 	bundle = r_context()->install_info->mounted_bundle;
+-	if (bundle) {
++	if (bundle && bundle->verified_chain) {
  		gchar **hashes = NULL;
  		gchar *string = NULL;
- 
--- 
-2.21.0
-
+

+					"failed signing bundle: ");
+			return FALSE;
+		}
 
+		if (!output_stream_write_bytes_all((GOutputStream *)bundlestream, sig, NULL, &ierror)) {
+			g_propagate_prefixed_error(
+					error,

-				"failed to append signature to bundle: ");
-		return FALSE;
-	}

+	/* append signature bytes, if not disabled */
+	if (!r_context()->bundle_nosig) {
+		g_assert_nonnull(r_context()->certpath);
