diff --git a/tools/release-3-perform-release.sh b/tools/release-3-perform-release.sh
index 447365bd4c3..fa3e7b644ab 100755
--- a/tools/release-3-perform-release.sh
+++ b/tools/release-3-perform-release.sh
@@ -29,8 +29,11 @@
 # 1. Do a simple release-perform command skip signing of artifacts and deploy to local directory (inside the Docker container)
 docker compose run --rm releaser bash /ws/mvnw -e -Dmaven.repo.local=/ws/out/.repository -DaltDeploymentRepository=snapshot-repo::default::file:/ws/out/.local-artifacts-dir release:perform
 
-# 2. Sign the artifacts
-# TODO: it seems the gpg sign plugin only signs one artifact ... gotta find out how to sign every jar in out/.local-artifacts-dir
+# 2. Sign all artifacts
+find ./out/.local-artifacts-dir -print | grep -E '^((.*\.pom)|(.*\.jar)|(.*\.kar)|(.*\.nar)|(.*-features\.xml)|(.*-cycloneds\.json)|(.*-cycloneds\.xml)|(.*-site\.xml)|(.*\.zip))$' | while read -r line ; do
+    echo "Processing $line"
+    gpg -ab "$line"
+done
 
 # 3. Deploy the artifacts to Nexus
 # TODO: Use the same technique we use on Jenkins to deploy everything in a local repo