diff --git a/src/config/NTMakefile.amd64_w2k b/src/config/NTMakefile.amd64_w2k
index 0624eed9ef..554808b03c 100644
--- a/src/config/NTMakefile.amd64_w2k
+++ b/src/config/NTMakefile.amd64_w2k
@@ -314,9 +314,15 @@ _VC_MANIFEST_EMBED_EXE=
 _VC_MANIFEST_EMBED_DLL=
 !ENDIF
 
+!IF "$(SIGNTOOL)" == ""
+SIGNTOOL=signtool.exe
+!ENDIF
+
 !IF DEFINED(CODESIGN_DESC) && DEFINED(CODESIGN_URL) && DEFINED(CODESIGN_TIMESTAMP)
-CODESIGN_USERLAND= signtool.exe sign /a /d "$(CODESIGN_DESC)" /du $(CODESIGN_URL) \
-        /t $(CODESIGN_TIMESTAMP) /v $@
+CODESIGN_USERLAND= "$(SIGNTOOL)" sign /a /d "$(CODESIGN_DESC)" /du $(CODESIGN_URL) /t $(CODESIGN_TIMESTAMP) /v $@
+!IF "$(CODESIGN_CROSS_CERT)" != ""
+CODESIGN_KERNEL= "$(SIGNTOOL)" sign /a /d "$(CODESIGN_DESC)" /du $(CODESIGN_URL) /t $(CODESIGN_TIMESTAMP) /ac "$(CODESIGN_CROSS_CERT)" /v
+!ENDIF
 !ELSE
 CODESIGN_USERLAND=
 !ENDIF
diff --git a/src/config/NTMakefile.i386_w2k b/src/config/NTMakefile.i386_w2k
index 3afdb7633e..47dbb92168 100644
--- a/src/config/NTMakefile.i386_w2k
+++ b/src/config/NTMakefile.i386_w2k
@@ -321,9 +321,17 @@ _VC_MANIFEST_EMBED_EXE=
 _VC_MANIFEST_EMBED_DLL=
 !ENDIF
 
+!IF "$(SIGNTOOL)" == ""
+SIGNTOOL=signtool.exe
+!ENDIF
+
 !IF DEFINED(CODESIGN_DESC) && DEFINED(CODESIGN_URL) && DEFINED(CODESIGN_TIMESTAMP)
-CODESIGN_USERLAND= signtool.exe sign /a /d "$(CODESIGN_DESC)" /du $(CODESIGN_URL) \
+CODESIGN_USERLAND= $(SIGNTOOL) sign /a /d "$(CODESIGN_DESC)" /du $(CODESIGN_URL) \
         /t $(CODESIGN_TIMESTAMP) /v $@
+!IF "$(CODESIGN_CROSS_CERT)" != ""
+CODESIGN_KERNEL= $(SIGNTOOL) sign /a /d "$(CODESIGN_DESC)" /du $(CODESIGN_URL) \
+        /t $(CODESIGN_TIMESTAMP) /ac "$(CODESIGN_CROSS_CERT)" /v
+!ENDIF
 !ELSE
 CODESIGN_USERLAND=
 !ENDIF