diff --git a/.config/jj/config.toml b/.config/jj/config.toml
index 6fe98309..be97acdb 100644
--- a/.config/jj/config.toml
+++ b/.config/jj/config.toml
@@ -62,7 +62,6 @@ key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINCttH8nEfk1uZ2291P4mbCoNcHxnr9iNBlbZ
 backends.ssh.program = "/Applications/1Password.app/Contents/MacOS/op-ssh-sign"
 
 [git]
-sign-on-push = true
 private-commits = "private() | wip()"
 write-change-id-header = true
 track-default-bookmark-on-clone = false
@@ -143,6 +142,7 @@ bookmark-advance-to = 'closest_pushable(@)'
 # Default, minus the megamerge bookmark, so advancing lands on the trunk-side
 # bookmark under it. Pattern form is empty when `mm` is gone; bare `mm` errors.
 bookmark-advance-from = 'heads(::to & bookmarks() & ~bookmarks(exact:"mm"))'
+git-sign-on-push = "~signed() & mine()"
 
 [revset-aliases]
 'immutable_heads()' = 'builtin_immutable_heads() | heads(~mine())'