diff --git a/.github/workflows/BuildPR.yml b/.github/workflows/BuildPR.yml
index 95ed550f..a7902841 100644
--- a/.github/workflows/BuildPR.yml
+++ b/.github/workflows/BuildPR.yml
@@ -57,7 +57,18 @@ jobs:
       - name: Unlink openssl 3
         run: |
           brew unlink openssl@3
-#      - name: Test project
-#        run: make test ARCH=${{ matrix.abi }}
+      - name: Test project
+        id: run-unit-tests
+        run: |
+          make test \
+            ARCH=${{ matrix.abi }} \
+            RESULT_BUNDLE=UnitTestResults-${{ matrix.abi }}.xcresult
+      - name: Upload unit test results
+        if: ${{ failure() && steps.run-unit-tests.outcome == 'failure' }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: UnitTestResults-${{ matrix.abi }}.xcresult
+          path: UnitTestResults-${{ matrix.abi }}.xcresult
+          retention-days: ${{ github.event_name == 'pull_request' && 7 || 90 }}
       - name: Archive project
         run: make archive ARCH=${{ matrix.abi }}
diff --git a/Makefile b/Makefile
index 15710da9..aa6886b7 100644
--- a/Makefile
+++ b/Makefile
@@ -20,6 +20,11 @@ DESTINATION := platform=macOS,arch=$(ARCH)
 LIBGIT2_ARCHIVE := External/libgit2.a
 LIBGIT2_BUILD_DIR := External/libgit2/build
 
+# Set to a path to have xcodebuild write an .xcresult bundle, which is where CI
+# reads failed unit test results back out of a test run.
+RESULT_BUNDLE ?=
+RESULT_BUNDLE_ARG := $(if $(RESULT_BUNDLE),-resultBundlePath $(RESULT_BUNDLE))
+
 XCODEBUILD := xcodebuild -workspace $(WORKSPACE) -scheme "$(SCHEME)" ARCHS="$(ARCH)"
 
 MAKEFILE := $(firstword $(MAKEFILE_LIST))
@@ -101,7 +106,7 @@ build: git-submodule-check ## Build the macOS framework
 	$(XCODEBUILD) -destination "$(DESTINATION)" build
 
 test: git-submodule-check ## Run the macOS framework specs
-	$(XCODEBUILD) -destination "$(DESTINATION)" test
+	$(XCODEBUILD) -destination "$(DESTINATION)" $(RESULT_BUNDLE_ARG) test
 
 archive: git-submodule-check ## Build a release archive of the macOS framework
 	$(XCODEBUILD) archive
diff --git a/ObjectiveGitFramework.xcodeproj/project.pbxproj b/ObjectiveGitFramework.xcodeproj/project.pbxproj
index 22f60cad..61072f74 100644
--- a/ObjectiveGitFramework.xcodeproj/project.pbxproj
+++ b/ObjectiveGitFramework.xcodeproj/project.pbxproj
@@ -1763,6 +1763,12 @@
 					"$(inherited)",
 					"-DGIT_SSH",
 				);
+				// Override the vendored Carthage/Checkouts/xcconfigs Debug.xcconfig,
+				// which hardcodes "--digest-algorithm=sha1". Current codesign
+				// rejects SHA-1 outright ("signing with only SHA1 not allowed"),
+				// so drop it here and keep only the network-independent timestamp
+				// opt-out.
+				OTHER_CODE_SIGN_FLAGS = "--timestamp=none";
 				SWIFT_VERSION = 5.0;
 				TARGETED_DEVICE_FAMILY = "1,2";
 				WARNING_CFLAGS = (
diff --git a/ObjectiveGitTests/GTSubmoduleSpec.m b/ObjectiveGitTests/GTSubmoduleSpec.m
index 5575c120..809c0f6e 100644
--- a/ObjectiveGitTests/GTSubmoduleSpec.m
+++ b/ObjectiveGitTests/GTSubmoduleSpec.m
@@ -246,7 +246,15 @@
 
 		__block NSError *error = nil;
 		expect(@([submodule sync:&error])).to(beTruthy());
-		expect([config stringForKey:configKey]).to(equal(@"../Test_App"));
+
+		// The fixture repository has no "origin" remote configured, so
+		// libgit2 resolves the submodule's relative URL ("../Test_App")
+		// against the parent repository's working directory instead of a
+		// remote URL, producing an absolute path to the sibling Test_App
+		// fixture rather than leaving the URL as the relative string.
+		NSString *expectedURL = [repo.fileURL URLByDeletingLastPathComponent].path;
+		expectedURL = [expectedURL stringByAppendingPathComponent:@"Test_App"];
+		expect([config stringForKey:configKey]).to(equal(expectedURL));
 	});
 });
 
diff --git a/script/update_libgit2 b/script/update_libgit2
index 0495f0e2..faf306e3 100755
--- a/script/update_libgit2
+++ b/script/update_libgit2
@@ -68,6 +68,7 @@ cmake --version
 cmake -DBUILD_SHARED_LIBS:BOOL=OFF \
   -DBUILD_TESTS:BOOL=OFF \
   -DTHREADSAFE:BOOL=ON \
+  -DUSE_SSH=libssh2 \
   -DCMAKE_POLICY_VERSION_MINIMUM=3.5 \
   ..
 cmake --build .