diff --git a/src/sbsign/sbsign.c b/src/sbsign/sbsign.c
index 6f4845135f..ec38d185a6 100644
--- a/src/sbsign/sbsign.c
+++ b/src/sbsign/sbsign.c
@@ -258,13 +258,9 @@ static int verb_sign(int argc, char *argv[], void *userdata) {
         if (r < 0)
                 log_debug_errno(r, "Failed to change temporary file mode: %m");
 
-        r = copy_bytes(srcfd, dstfd, UINT64_MAX, COPY_REFLINK);
-        if (r < 0)
-                return log_error_errno(r, "Failed to copy %s to %s: %m", argv[1], tmp);
-
         _cleanup_free_ void *hash = NULL;
         size_t hashsz;
-        r = pe_hash(dstfd, EVP_sha256(), &hash, &hashsz);
+        r = pe_hash(srcfd, EVP_sha256(), &hash, &hashsz);
         if (r < 0)
                 return log_error_errno(r, "Failed to hash PE binary %s: %m", argv[0]);
 
@@ -411,6 +407,10 @@ static int verb_sign(int argc, char *argv[], void *userdata) {
         if (!certificate_table)
                 return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "File lacks certificate table.");
 
+        r = copy_bytes(srcfd, dstfd, UINT64_MAX, COPY_REFLINK);
+        if (r < 0)
+                return log_error_errno(r, "Failed to copy %s to %s: %m", argv[1], tmp);
+
         off_t end = st.st_size;
         ssize_t n;