diff --git a/tools/fleetctl-docker/Dockerfile b/tools/fleetctl-docker/Dockerfile
index ca678cedf7..d6b4db720e 100644
--- a/tools/fleetctl-docker/Dockerfile
+++ b/tools/fleetctl-docker/Dockerfile
@@ -2,7 +2,7 @@ FROM rust:latest@sha256:56418f03475cf7b107f87d7fabe99ce9a4a9f9904daafa99be7c50d9
 
 ARG transporter_url=https://itunesconnect.apple.com/WebObjects/iTunesConnect.woa/ra/resources/download/public/Transporter__Linux/bin
 
-RUN cargo install --locked --version 0.16.0 apple-codesign \
+RUN cargo install --locked --version 0.28.0 apple-codesign \
   && curl -sSf $transporter_url -o transporter_install.sh \
   && sh transporter_install.sh --target transporter --accept --noexec
 
diff --git a/tools/fleetctl-docker/README.md b/tools/fleetctl-docker/README.md
index c4ecc78593..7f4f2c97fd 100644
--- a/tools/fleetctl-docker/README.md
+++ b/tools/fleetctl-docker/README.md
@@ -28,17 +28,17 @@ make fleetctl-docker
 
 To sign and notarize a generated `pkg` you must have:
 
-1. A Developer ID certificate in PEM format
-2. An Apple Store Connect API key
+1. A Developer ID Application certificate in PEM format
+2. An Apple Store Connect API key with App Manager access
 
 > Note: the Developer ID certificate must be in PEM format because this image
 > can be run in automated environments where secrets are passed via environment
 > variables, and thus they must be in plain text.
 >
-> To convert a PKCS 12 certificate to PEM, you can run the following command:
+> To convert a DER (.cer) certificate to PEM, you can run the following command:
 >
 > ```
-> openssl pkcs12 -in /path/to/cert.p12 -out signing-keypair.pem -nodes
+> openssl x509 -inform der -outform pem -in developerID_application.cer -out developerID_application.pem
 > ```
 
 Once you are set, you can build and notarize/staple your package with: