diff --git a/.github/workflows/create_certs.yml b/.github/workflows/create_certs.yml
index 2f8bde21b..090cec230 100644
--- a/.github/workflows/create_certs.yml
+++ b/.github/workflows/create_certs.yml
@@ -47,9 +47,15 @@ jobs:
 
       # Create or update Distribution certificate and provisioning profiles
       - name: Check and create or update Distribution certificate and profiles if needed
+        id: certs
         run: |
           echo "Running Fastlane certs lane..."
-          bundle exec fastlane certs || true # ignore and continue on errors without annotating an exit code
+          # Continue on errors without annotating an exit code; set_output fails the job if no renewal follows
+          if bundle exec fastlane certs; then
+            echo "certs_failed=false" >> $GITHUB_OUTPUT
+          else
+            echo "certs_failed=true" >> $GITHUB_OUTPUT
+          fi
 
       - name: Check Distribution certificate and launch Nuke certificates if needed
         run: bundle exec fastlane check_and_renew_certificates
@@ -88,6 +94,12 @@ jobs:
             echo "::warning::‼️ Nuking of certificates was forced because the repository variable FORCE_NUKE_CERTS is set to 'true'."
           fi
 
+          # Fail if the certificate setup failed and no renewal will replace it
+          if [ "${{ steps.certs.outputs.certs_failed }}" = "true" ] && [ "$CERT_STATUS" != "true" ] && [ "$FORCE_NUKE_CERTS" != "true" ]; then
+            echo "::error::❌ Fastlane Match could not use the Distribution certificate in your Match-Secrets repository, and automated renewal will not run because another valid certificate exists. Delete https://github.com/${{ github.repository_owner }}/Match-Secrets and run action again: https://loopkit.github.io/loopdocs/browser/bb-errors/#delete-match-secrets"
+            exit 1
+          fi
+
   # Nuke Certs if needed, and if the repository variable ENABLE_NUKE_CERTS is set to 'true', or if FORCE_NUKE_CERTS is set to 'true', which will always force certs to be nuked
   nuke_certs:
     name: Nuke certificates
diff --git a/fastlane/Fastfile b/fastlane/Fastfile
index 8bf9986ce..254fa0782 100644
--- a/fastlane/Fastfile
+++ b/fastlane/Fastfile
@@ -247,7 +247,9 @@ platform :ios do
       issuer_id: "#{FASTLANE_ISSUER_ID}",
       key_content: "#{FASTLANE_KEY}"
     )
-    
+
+    ensure_watch_identifiers_exist
+
     match(
       type: "appstore",
       force: false,