diff --git a/editor.py b/editor.py
index 2d8817a..cd5ac83 100644
--- a/editor.py
+++ b/editor.py
@@ -157,13 +157,24 @@ def start_build_job(content: str) -> str:
                 append_lines(state, "✗ BUILD FAILED — see lines above")
                 return
 
-            # 4. Package the IPA (fresh zip; remove the old one first)
+            # 4. Package the IPA (fresh zip; remove the old one first).
+            #    Sign the APPEX FIRST with Widget.entitlements, then the app
+            #    with App.entitlements. A bare `codesign --deep -s -` leaves
+            #    the appex UNSIGNED and embeds NO entitlements, so SideStore
+            #    re-signs without application-groups/keychain groups and the
+            #    widget cannot read favourites from the shared container.
             app = REPO / "build" / "Build" / "Products" / "Release-iphoneos" / "FuelBoard.app"
             work = Path("/tmp/ipa-work")
             shutil.rmtree(work, ignore_errors=True)
             (work / "Payload").mkdir(parents=True)
             shutil.copytree(app, work / "Payload" / "FuelBoard.app")
-            subprocess.run(["codesign", "--force", "--deep", "-s", "-",
+            appex = work / "Payload" / "FuelBoard.app" / "PlugIns" / "FuelBoardWidgets.appex"
+            subprocess.run(["codesign", "--force", "-s", "-",
+                            "--entitlements", str(REPO / "Config" / "Widget.entitlements"),
+                            str(appex)],
+                           check=True, capture_output=True)
+            subprocess.run(["codesign", "--force", "-s", "-",
+                            "--entitlements", str(REPO / "Config" / "App.entitlements"),
                             str(work / "Payload" / "FuelBoard.app")],
                            check=True, capture_output=True)
             IPA_SERVE_DIR.mkdir(parents=True, exist_ok=True)