diff --git a/app/scripts/after-pack.mjs b/app/scripts/after-pack.mjs
index e281b56..9944c3e 100644
--- a/app/scripts/after-pack.mjs
+++ b/app/scripts/after-pack.mjs
@@ -24,8 +24,9 @@ export default async function afterPack(context) {
 }
 
 /**
- * Sign the CDM through castLabs EVS, when this platform needs it and an account is present. A failure here is fatal:
- * a build that claims Widevine but ships an unverifiable CDM is worse than a build that stops.
+ * Sign the CDM through castLabs EVS, when this platform needs it and an account is present. A refusal from EVS does not
+ * stop the build: the app ships with an unverifiable CDM, as it does without an account, so DRM services decline to
+ * play while everything else works. The log says so, and the docs do not promise paid streaming until it is signed.
  * @param {import("electron-builder").AfterPackContext} context
  */
 function vmpSign(context) {
@@ -36,8 +37,12 @@ function vmpSign(context) {
     return;
   }
   const { command, args } = vmpCommand(electronPlatformName, appOutDir);
-  execFileSync(command, args, { stdio: "inherit" });
-  console.log(`VMP signed ${appOutDir} with the EVS account ${plan.account}`);
+  try {
+    execFileSync(command, args, { stdio: "inherit" });
+    console.log(`VMP signed ${appOutDir} with the EVS account ${plan.account}`);
+  } catch (error) {
+    console.log(`::warning::VMP signing refused for the EVS account ${plan.account}; this build ships an unsigned CDM (${error.message})`);
+  }
 }
 
 /** Where the packaged executable sits for each platform. */
diff --git a/docs/STATUS.md b/docs/STATUS.md
index 00ba14e..6bec3ac 100644
--- a/docs/STATUS.md
+++ b/docs/STATUS.md
@@ -10,7 +10,7 @@ O alpha destina-se somente ao Windows 10/11, x64 e arm64. macOS, Linux, Steam De
 
 - CI Windows (`electron (windows-latest)`) verde no commit da release: typecheck, unitários, teste do script de versão, e2e com o Electron real e o smoke test do instalador, que instala o `.exe` e confirma que o app abre.
 - Motor castLabs ECS `v44.9.3+wvcus`, que corrige o alerta de certificados eMudhra (Electron < 44.9.1).
-- CDM assinada pela conta EVS no build da release (o log do job `build` registra a assinatura VMP).
+- **CDM sem assinatura VMP:** a conta EVS autentica, mas a castLabs recusou a assinatura `streaming` ("Binary signature denied"). A alpha sai com a CDM sem assinatura, então Netflix, Prime e outros serviços com Widevine não tocam. O build registra a recusa como aviso e segue; quando a conta for liberada, a próxima release sai assinada sem mudar código.
 
 ## O que ainda fecha o alpha