diff --git a/src/SiteExtensions/build/repo.props b/src/SiteExtensions/build/repo.props
index 25129c9001..eca3003474 100644
--- a/src/SiteExtensions/build/repo.props
+++ b/src/SiteExtensions/build/repo.props
@@ -3,6 +3,8 @@
 
   <ItemGroup>
     <ExcludeFromPack Include="$(RepositoryRoot)src\Microsoft.Web.Xdt.Extensions\*.csproj" />
+
+    <SignCheckExclusionsFile>$(RepositoryRoot)eng\signcheck.exclusions.txt</SignCheckExclusionsFile>
   </ItemGroup>
 
 </Project>
diff --git a/src/SiteExtensions/eng/signcheck.exclusions.txt b/src/SiteExtensions/eng/signcheck.exclusions.txt
new file mode 100644
index 0000000000..4f16d97025
--- /dev/null
+++ b/src/SiteExtensions/eng/signcheck.exclusions.txt
@@ -0,0 +1 @@
+content/sdk/*/AppHostTemplate/apphost.exe;AspNetCoreRuntime.*.nupkg; Exclude the apphost because this is expected to be code-signed by customers after the SDK modifies it.