diff --git a/maven/update-version.sh b/maven/update-version.sh
index 396411f2f3..d0a1e08d11 100755
--- a/maven/update-version.sh
+++ b/maven/update-version.sh
@@ -82,11 +82,31 @@ if [ -f "$gbParent" ]; then
   perl -pi -e "s{<cn1\.plugin\.version>\Q$oldVersion\E</cn1\.plugin\.version>}{<cn1.plugin.version>$version</cn1.plugin.version>}g" "$gbParent"
 fi
 
+# Signing/Certificate Wizard editor (scripts/certificatewizard) is the same
+# shape as the Game Builder above: an out-of-reactor Codename One desktop app
+# with its own coordinates that the release workflow deploys to Central. If its
+# module version is not bumped to the release version it stays 8.0-SNAPSHOT, so
+# `mvn deploy` targets the Central *snapshots* repo and fails with 403 Forbidden
+# (the release job has no snapshot-publish rights). Rewrite its module version
+# plus the cn1.version/cn1.plugin.version it builds against, matching the
+# gamebuilder handling.
+for f in ../scripts/certificatewizard/pom.xml \
+         ../scripts/certificatewizard/common/pom.xml \
+         ../scripts/certificatewizard/javase/pom.xml; do
+  [ -f "$f" ] && perl -pi -e "s{<version>\Q$oldVersion\E</version>}{<version>$version</version>}g" "$f"
+done
+cwParent=../scripts/certificatewizard/pom.xml
+if [ -f "$cwParent" ]; then
+  perl -pi -e "s{<cn1\.version>\Q$oldVersion\E</cn1\.version>}{<cn1.version>$version</cn1.version>}g" "$cwParent"
+  perl -pi -e "s{<cn1\.plugin\.version>\Q$oldVersion\E</cn1\.plugin\.version>}{<cn1.plugin.version>$version</cn1.plugin.version>}g" "$cwParent"
+fi
+
 echo "Committing version change in git"
 git add -u .
 # Note: the -u is to prevent adding files that aren't added to git yet.  Only changed
 # files.  This is to help avoid accidents.
 git add -u ../scripts/gamebuilder
+git add -u ../scripts/certificatewizard
 git commit -m "Updated version to $version"
 if [[ "$version" == *-SNAPSHOT ]]; then
   echo "This is a snapshot version so not adding a tag"